{"grype_matches":[{"artifact":{"id":"e6497d47e316508b","cpes":["cpe:2.3:a:brotli-libs:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli-libs:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli_libs:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli_libs:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:google:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:google:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*"],"name":"brotli-libs","purl":"pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=alpine-3.24&upstream=brotli","type":"apk","version":"1.2.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libbrotlicommon.so.1"},{"path":"/usr/lib/libbrotlicommon.so.1.2.0"},{"path":"/usr/lib/libbrotlidec.so.1"},{"path":"/usr/lib/libbrotlidec.so.1.2.0"},{"path":"/usr/lib/libbrotlienc.so.1"},{"path":"/usr/lib/libbrotlienc.so.1.2.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"brotli"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 1.2.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"brotli","version":"1.2.0-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["1.2.1-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.2.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-25","epss":0.32782,"percentile":0.98336}],"risk":29.831619999999997,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111497"},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-25","epss":0.32782,"percentile":0.98336}],"urls":["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-62r4-hw23-cc8v","versionConstraint":">=1.0.0,<2.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-62r4-hw23-cc8v","fix":{"state":"fixed","versions":["2.0.0"],"available":[{"date":"2025-12-27","kind":"first-observed","version":"2.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":9.9,"impactScore":6,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68668","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68668","date":"2026-10-25","epss":0.13167,"percentile":0.96334}],"risk":12.442815000000001,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v","https://nvd.nist.gov/vuln/detail/CVE-2025-68668","https://www.smartkeyss.com/post/cve-2025-68668-breaking-out-of-the-python-sandbox-in-n8n"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-62r4-hw23-cc8v","description":"n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node"},"relatedVulnerabilities":[{"id":"CVE-2025-68668","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":9.9,"impactScore":6,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68668","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68668","date":"2026-10-25","epss":0.13167,"percentile":0.96334}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v","https://www.smartkeyss.com/post/cve-2025-68668-breaking-out-of-the-python-sandbox-in-n8n"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68668","description":"n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: \"[\\\"n8n-nodes-base.code\\\"]\", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables."}]},{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-0770","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-0770","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-0770","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-0770","date":"2026-10-25","epss":0.05403,"percentile":0.92627}],"risk":4.538520000000001,"urls":["http://secunia.com/advisories/24167","http://secunia.com/advisories/24196","http://www.debian.org/security/2007/dsa-1260","http://www.mandriva.com/security/advisories?name=MDKSA-2007:041","http://www.novell.com/linux/security/advisories/2007_3_sr.html","http://www.osvdb.org/31911","http://www.securityfocus.com/archive/1/459507/100/0/threaded","http://www.ubuntu.com/usn/usn-422-1","https://issues.rpath.com/browse/RPL-1034"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-0770","description":"Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456."},"relatedVulnerabilities":[]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5026","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-25","epss":0.01834,"percentile":0.78763}],"risk":1.4396899999999997,"urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/767220","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."},"relatedVulnerabilities":[{"id":"CVE-2026-39821","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-25","epss":0.01834,"percentile":0.78763}],"urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106446","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106446","date":"2026-10-25","epss":0.00786,"percentile":0.5585}],"risk":0.73884,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)"},"relatedVulnerabilities":[{"id":"CVE-2026-106446","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106446","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106446","date":"2026-10-25","epss":0.00786,"percentile":0.5585}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4981","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4981","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-25","epss":0.00875,"percentile":0.58698}],"risk":0.6562500000000001,"urls":["https://go.dev/cl/767860","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78803","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-33811","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-25","epss":0.00875,"percentile":0.58698}],"urls":["https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4981","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4918","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-25","epss":0.0084,"percentile":0.57598}],"risk":0.63,"urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/761581","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."},"relatedVulnerabilities":[{"id":"CVE-2026-33814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-25","epss":0.0084,"percentile":0.57598}],"urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4977","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4977","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-25","epss":0.00798,"percentile":0.56236}],"risk":0.5984999999999999,"urls":["https://go.dev/cl/771520","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78987","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."},"relatedVulnerabilities":[{"id":"CVE-2026-42499","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-25","epss":0.00798,"percentile":0.56236}],"urls":["https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4977","https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4986","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4986","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-25","epss":0.00784,"percentile":0.55763}],"risk":0.588,"urls":["https://go.dev/cl/759940","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78566","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-39820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-25","epss":0.00784,"percentile":0.55763}],"urls":["https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4986","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4601","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4601","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-25","epss":0.00774,"percentile":0.55455}],"risk":0.5805,"urls":["https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/752180","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-25679","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-25","epss":0.00774,"percentile":0.55455}],"urls":["https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4601","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.29.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-777w-rpr6-c52h","versionConstraint":"<2.29.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-777w-rpr6-c52h","fix":{"state":"fixed","versions":["2.29.8"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.29.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65595","cwe":"CWE-269","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65595","date":"2026-10-25","epss":0.00693,"percentile":0.52626}],"risk":0.56826,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h","https://nvd.nist.gov/vuln/detail/CVE-2026-65595","https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8","https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1","https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-777w-rpr6-c52h","description":"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs"},"relatedVulnerabilities":[{"id":"CVE-2026-65595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65595","cwe":"CWE-269","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65595","date":"2026-10-25","epss":0.00693,"percentile":0.52626}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h","https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65595","description":"n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-25","epss":0.00622,"percentile":0.49496}],"risk":0.56291,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-25","epss":0.00622,"percentile":0.49496}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8398-gmmx-564h","versionConstraint":"<2.4.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8398-gmmx-564h","fix":{"state":"fixed","versions":["2.4.8"],"available":[{"date":"2026-02-05","kind":"first-observed","version":"2.4.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25115","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25115","date":"2026-10-25","epss":0.00585,"percentile":0.47687}],"risk":0.5455125000000001,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-8398-gmmx-564h","https://nvd.nist.gov/vuln/detail/CVE-2026-25115","https://github.com/n8n-io/n8n/commit/8607d372f78c388bb3691d9d5b52af7259ec7b1f"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8398-gmmx-564h","description":"n8n has a Python sandbox escape"},"relatedVulnerabilities":[{"id":"CVE-2026-25115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25115","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25115","date":"2026-10-25","epss":0.00585,"percentile":0.47687}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-8398-gmmx-564h"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25115","description":"n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue has been patched in version 2.4.8."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v5mp-jgw5-2x6j","versionConstraint":"<4.1.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v5mp-jgw5-2x6j","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63376","date":"2026-10-25","epss":0.00683,"percentile":0.52271}],"risk":0.5361549999999999,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j","https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v5mp-jgw5-2x6j","description":"toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-63376","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63376","date":"2026-10-25","epss":0.00683,"percentile":0.52271}],"urls":["https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63376","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106445","date":"2026-10-25","epss":0.00589,"percentile":0.47861}],"risk":0.53599,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","description":"Handlebars: JavaScript Injection via Own Property Check Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-106445","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106445","date":"2026-10-25","epss":0.00589,"percentile":0.47861}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-25","epss":0.00553,"percentile":0.45941}],"risk":0.5198200000000001,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-25","epss":0.00553,"percentile":0.45941}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hh89-3r9w-qj3j","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hh89-3r9w-qj3j","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-10","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86075","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86075","date":"2026-10-25","epss":0.00609,"percentile":0.48853}],"risk":0.49328999999999995,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3j","https://nvd.nist.gov/vuln/detail/CVE-2026-86075","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hh89-3r9w-qj3j","description":"n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint"},"relatedVulnerabilities":[{"id":"CVE-2026-86075","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86075","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86075","date":"2026-10-25","epss":0.00609,"percentile":0.48853}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3j"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86075","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4971","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4971","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-25","epss":0.00633,"percentile":0.50028}],"risk":0.47475,"urls":["https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://go.dev/cl/775320"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79006","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."},"relatedVulnerabilities":[{"id":"CVE-2026-39836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-25","epss":0.00633,"percentile":0.50028}],"urls":["https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4971"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39836","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-25","epss":0.00627,"percentile":0.4977}],"risk":0.47025,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-25","epss":0.00627,"percentile":0.4977}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4870","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4870","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-25","epss":0.00621,"percentile":0.49483}],"risk":0.46575,"urls":["https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763767","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3."},"relatedVulnerabilities":[{"id":"CVE-2026-32283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-25","epss":0.00621,"percentile":0.49483}],"urls":["https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4870","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qrx8-25qr-5r7v","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qrx8-25qr-5r7v","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"impactScore":6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54309","cwe":"CWE-306","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54309","date":"2026-10-25","epss":0.00546,"percentile":0.45483}],"risk":0.46136999999999995,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v","https://nvd.nist.gov/vuln/detail/CVE-2026-54309"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qrx8-25qr-5r7v","description":"n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions"},"relatedVulnerabilities":[{"id":"CVE-2026-54309","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"impactScore":6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54309","cwe":"CWE-306","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54309","date":"2026-10-25","epss":0.00546,"percentile":0.45483}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54309","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4947","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4947","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-25","epss":0.00615,"percentile":0.49143}],"risk":0.46125000000000005,"urls":["https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758320","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."},"relatedVulnerabilities":[{"id":"CVE-2026-32280","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-25","epss":0.00615,"percentile":0.49143}],"urls":["https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4947","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-25","epss":0.00614,"percentile":0.49111}],"risk":0.46049999999999996,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-25","epss":0.00614,"percentile":0.49111}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-82x6-q7mm-w9cf","versionConstraint":"<4.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-82x6-q7mm-w9cf","fix":{"state":"fixed","versions":["4.2.0"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"4.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77465","date":"2026-10-25","epss":0.00609,"percentile":0.48861}],"risk":0.45675000000000004,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-82x6-q7mm-w9cf","description":"toml-node: Uncontrolled Recursion"},"relatedVulnerabilities":[{"id":"CVE-2026-77465","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77465","date":"2026-10-25","epss":0.00609,"percentile":0.48861}],"urls":["https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77465","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."}]},{"artifact":{"id":"f5deb992baf9d929","cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"name":"postcss","purl":"pkg:npm/postcss@8.5.6","type":"npm","version":"8.5.6","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.5.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss","version":"8.5.6"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6g55-p6wh-862q","fix":{"state":"fixed","versions":["8.5.12"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"8.5.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45623","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45623","date":"2026-10-25","epss":0.00608,"percentile":0.48774}],"risk":0.45599999999999996,"urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments"},"relatedVulnerabilities":[{"id":"CVE-2026-45623","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45623","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45623","date":"2026-10-25","epss":0.00608,"percentile":0.48774}],"urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12."}]},{"artifact":{"id":"ccb14fe030e82f5d","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-858h-whjf-mvg5","versionConstraint":"<=3.36.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-858h-whjf-mvg5","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102827","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102827","date":"2026-10-25","epss":0.00576,"percentile":0.47244}],"risk":0.44928000000000007,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5","https://nvd.nist.gov/vuln/detail/CVE-2026-102827","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-858h-whjf-mvg5","description":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)"},"relatedVulnerabilities":[{"id":"CVE-2026-102827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102827","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102827","date":"2026-10-25","epss":0.00576,"percentile":0.47244}],"urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102827","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.29.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5vx-c2c8-m3w9","versionConstraint":"<2.29.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x5vx-c2c8-m3w9","fix":{"state":"fixed","versions":["2.29.8"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.29.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65015","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65015","date":"2026-10-25","epss":0.00608,"percentile":0.48819}],"risk":0.44688,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9","https://nvd.nist.gov/vuln/detail/CVE-2026-65015","https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8","https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1","https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5vx-c2c8-m3w9","description":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool"},"relatedVulnerabilities":[{"id":"CVE-2026-65015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65015","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65015","date":"2026-10-25","epss":0.00608,"percentile":0.48819}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9","https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65015","description":"n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5037","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5037","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-25","epss":0.00591,"percentile":0.47958}],"risk":0.4432500000000001,"urls":["https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/783621","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname.\n\nWith a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."},"relatedVulnerabilities":[{"id":"CVE-2026-27145","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-25","epss":0.00591,"percentile":0.47958}],"urls":["https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5037","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5972","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5972","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814980"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80405","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."},"relatedVulnerabilities":[{"id":"CVE-2026-33818","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6089","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6089","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://go.dev/cl/795540","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80205","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."},"relatedVulnerabilities":[{"id":"CVE-2026-56853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6090","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6090","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80528","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-56862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6088","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6088","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-25","epss":0.00568,"percentile":0.46788}],"risk":0.426,"urls":["https://go.dev/cl/803320","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80481","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-56859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-25","epss":0.00568,"percentile":0.46788}],"urls":["https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6088"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5038","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5038","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-25","epss":0.0056,"percentile":0.4635}],"risk":0.42,"urls":["https://go.dev/cl/774481","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79217","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-42504","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-25","epss":0.0056,"percentile":0.4635}],"urls":["https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5038"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmmh-p597-ppvv","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rmmh-p597-ppvv","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-25","epss":0.00806,"percentile":0.56525}],"risk":0.41509,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-1899","https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmmh-p597-ppvv","description":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-1899","cvss":[{"type":"Secondary","source":"vulnreport@tenable.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-25","epss":0.00806,"percentile":0.56525}],"urls":["https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1899","description":"An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions."}]},{"artifact":{"id":"f5deb992baf9d929","cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"name":"postcss","purl":"pkg:npm/postcss@8.5.6","type":"npm","version":"8.5.6","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.5.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss","version":"8.5.6"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r28c-9q8g-f849","fix":{"state":"fixed","versions":["8.5.18"],"available":[{"date":"2026-07-24","kind":"first-observed","version":"8.5.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73646","date":"2026-10-25","epss":0.0053,"percentile":0.44508}],"risk":0.3975,"urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure"},"relatedVulnerabilities":[{"id":"CVE-2026-73646","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73646","date":"2026-10-25","epss":0.0053,"percentile":0.44508}],"urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-25","epss":0.00519,"percentile":0.43798}],"risk":0.38925,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-25","epss":0.00519,"percentile":0.43798}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-25","epss":0.00511,"percentile":0.43314}],"risk":0.38325,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-25","epss":0.00511,"percentile":0.43314}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"94dbd134b7196014","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3/node_modules/follow-redirects/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"risk":0.3697349999999999,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"bc99a183bc3ce5a6","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0/node_modules/follow-redirects/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"risk":0.3697349999999999,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"94dbd134b7196014","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3/node_modules/follow-redirects/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"risk":0.3697349999999999,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"bc99a183bc3ce5a6","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0/node_modules/follow-redirects/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"risk":0.3697349999999999,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-25","epss":0.00471,"percentile":0.40483}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-25","epss":0.0049,"percentile":0.41844}],"risk":0.3675,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-25","epss":0.0049,"percentile":0.41844}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"ccb14fe030e82f5d","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g4wm-2vf7-vfgr","versionConstraint":"<=3.36.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g4wm-2vf7-vfgr","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102826","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102826","date":"2026-10-25","epss":0.00464,"percentile":0.39907}],"risk":0.36192,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr","https://nvd.nist.gov/vuln/detail/CVE-2026-102826","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g4wm-2vf7-vfgr","description":"simple-git allows command execution through unblocked Git configuration includes"},"relatedVulnerabilities":[{"id":"CVE-2026-102826","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102826","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102826","date":"2026-10-25","epss":0.00464,"percentile":0.39907}],"urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102826","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-25","epss":0.0048,"percentile":0.41148}],"risk":0.36,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-25","epss":0.0048,"percentile":0.41148}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c37g-w77q-m4vp","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-c37g-w77q-m4vp","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","metrics":{"baseScore":6.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54310","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54310","date":"2026-10-25","epss":0.00545,"percentile":0.45428}],"risk":0.35969999999999996,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp","https://nvd.nist.gov/vuln/detail/CVE-2026-54310"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c37g-w77q-m4vp","description":"n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes"},"relatedVulnerabilities":[{"id":"CVE-2026-54310","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54310","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54310","date":"2026-10-25","epss":0.00545,"percentile":0.45428}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54310","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2."}]},{"artifact":{"id":"dadac940de538eca","cpes":["cpe:2.3:a:golang:text:v0.14.0:*:*:*:*:*:*:*"],"name":"golang.org/x/text","purl":"pkg:golang/golang.org/x/text@v0.14.0","type":"go-module","version":"v0.14.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=","mainModule":"task-runner-launcher","architecture":"amd64","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.39.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5970","versionConstraint":"<0.39.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/text","version":"v0.14.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5970","fix":{"state":"fixed","versions":["0.39.0"],"available":[{"date":"2026-06-30","kind":"release","version":"0.39.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56852","date":"2026-10-25","epss":0.00475,"percentile":0.40755}],"risk":0.35624999999999996,"urls":["https://go.dev/cl/794100"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80142","description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-56852","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56852","date":"2026-10-25","epss":0.00475,"percentile":0.40755}],"urls":["https://go.dev/cl/794100","https://go.dev/issue/80142","https://pkg.go.dev/vuln/GO-2026-5970"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"risk":0.35475,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mwp4-54f8-5fhr","versionConstraint":"<=10.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mwp4-54f8-5fhr","fix":{"state":"fixed","versions":["10.3.1"],"available":[{"date":"2026-08-04","kind":"first-observed","version":"10.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-69192","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69192","date":"2026-10-25","epss":0.00465,"percentile":0.39986}],"risk":0.3534,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mwp4-54f8-5fhr","description":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-69192","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-69192","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69192","date":"2026-10-25","epss":0.00465,"percentile":0.39986}],"urls":["https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1."}]},{"artifact":{"id":"dadac940de538eca","cpes":["cpe:2.3:a:golang:text:v0.14.0:*:*:*:*:*:*:*"],"name":"golang.org/x/text","purl":"pkg:golang/golang.org/x/text@v0.14.0","type":"go-module","version":"v0.14.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=","mainModule":"task-runner-launcher","architecture":"amd64","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.41.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/text","version":"v0.14.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6629","fix":{"state":"fixed","versions":["0.41.0"],"available":[{"date":"2026-08-11","kind":"release","version":"0.41.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56851","date":"2026-10-25","epss":0.00466,"percentile":0.40031}],"risk":0.3495,"urls":["https://go.dev/issue/80112"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/793360","description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer."},"relatedVulnerabilities":[{"id":"CVE-2026-56851","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56851","date":"2026-10-25","epss":0.00466,"percentile":0.40031}],"urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer."}]},{"artifact":{"id":"e40470cdfae0250f","cpes":["cpe:2.3:a:csv-parse_project:csv-parse:5.5.0:*:*:*:*:node.js:*:*"],"name":"csv-parse","purl":"pkg:npm/csv-parse@5.5.0","type":"npm","version":"5.5.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/csv-parse@5.5.0/node_modules/csv-parse/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/csv-parse@5.5.0/node_modules/csv-parse/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8cw4-87c7-c6xx","versionConstraint":"<7.0.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"csv-parse","version":"5.5.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8cw4-87c7-c6xx","fix":{"state":"fixed","versions":["7.0.2"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"7.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85063","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85063","date":"2026-10-25","epss":0.00566,"percentile":0.46685}],"risk":0.33677,"urls":["https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx","https://nvd.nist.gov/vuln/detail/CVE-2026-85063","https://github.com/adaltas/node-csv/issues/496","https://github.com/adaltas/node-csv/pull/497","https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8cw4-87c7-c6xx","description":"node-csv: Prototype replacement still reachable via columns path"},"relatedVulnerabilities":[{"id":"CVE-2026-85063","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85063","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85063","date":"2026-10-25","epss":0.00566,"percentile":0.46685}],"urls":["https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e","https://github.com/adaltas/node-csv/issues/496","https://github.com/adaltas/node-csv/pull/497","https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85063","description":"node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2."}]},{"artifact":{"id":"ccb14fe030e82f5d","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x6jw-m9v5-85vh","versionConstraint":">=3.15.0,<4.0.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x6jw-m9v5-85vh","fix":{"state":"fixed","versions":["4.0.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102828","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102828","date":"2026-10-25","epss":0.0037,"percentile":0.30634}],"risk":0.3367,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","https://nvd.nist.gov/vuln/detail/CVE-2026-102828","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x6jw-m9v5-85vh","description":"simple-git unsafe-operation guard does not block trailer command configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-102828","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102828","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102828","date":"2026-10-25","epss":0.0037,"percentile":0.30634}],"urls":["https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1","https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-33q9-f52j-gc75","versionConstraint":"<2.27.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-33q9-f52j-gc75","fix":{"state":"fixed","versions":["2.27.4"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.27.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65014","cwe":"CWE-306","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65014","date":"2026-10-25","epss":0.0059,"percentile":0.47919}],"risk":0.33335,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75","https://nvd.nist.gov/vuln/detail/CVE-2026-65014","https://github.com/n8n-io/n8n/releases/tag/n8n@2.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.0","https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-33q9-f52j-gc75","description":"n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook"},"relatedVulnerabilities":[{"id":"CVE-2026-65014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65014","cwe":"CWE-306","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65014","date":"2026-10-25","epss":0.0059,"percentile":0.47919}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75","https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65014","description":"n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected."}]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q7qp-rjg7-q26m","versionConstraint":">=2.0.0,<2.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q7qp-rjg7-q26m","fix":{"state":"fixed","versions":["2.5.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"2.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113872","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-113872","cwe":"CWE-404","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-113872","date":"2026-10-25","epss":0.00442,"percentile":0.38093}],"risk":0.3315,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m","https://nvd.nist.gov/vuln/detail/CVE-2026-113872","https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.5.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","description":"multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown"},"relatedVulnerabilities":[{"id":"CVE-2026-113872","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113872","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-113872","cwe":"CWE-404","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-113872","date":"2026-10-25","epss":0.00442,"percentile":0.38093}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872","description":"multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9qmh-m7c6-f92p","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-9qmh-m7c6-f92p","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-114144","cwe":"CWE-770","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114144","date":"2026-10-25","epss":0.0044,"percentile":0.3798}],"risk":0.33,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p","https://nvd.nist.gov/vuln/detail/CVE-2026-114144","https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","description":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114144","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-114144","cwe":"CWE-770","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114144","date":"2026-10-25","epss":0.0044,"percentile":0.3798}],"urls":["https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h44j-f5r5-ph73","versionConstraint":"<2.27.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h44j-f5r5-ph73","fix":{"state":"fixed","versions":["2.27.4"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.27.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59207","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59207","date":"2026-10-25","epss":0.00448,"percentile":0.38653}],"risk":0.32704,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-h44j-f5r5-ph73","https://nvd.nist.gov/vuln/detail/CVE-2026-59207","https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h44j-f5r5-ph73","description":"n8n: \"Allowed HTTP Request Domains\" Restriction Bypass via AI Agents MCP Connector"},"relatedVulnerabilities":[{"id":"CVE-2026-59207","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59207","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59207","date":"2026-10-25","epss":0.00448,"percentile":0.38653}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1","https://github.com/n8n-io/n8n/security/advisories/GHSA-h44j-f5r5-ph73"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59207","description":"n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-679f-58pq-4v2c","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-679f-58pq-4v2c","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-11","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86078","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86078","date":"2026-10-25","epss":0.00586,"percentile":0.47709}],"risk":0.32230000000000003,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c","https://nvd.nist.gov/vuln/detail/CVE-2026-86078","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-679f-58pq-4v2c","description":"n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-86078","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86078","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86078","date":"2026-10-25","epss":0.00586,"percentile":0.47709}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86078","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qx8-w7c3-pj3p","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qx8-w7c3-pj3p","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114141","date":"2026-10-25","epss":0.00395,"percentile":0.3348}],"risk":0.31995,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p","https://nvd.nist.gov/vuln/detail/CVE-2026-114141","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","description":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114141","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114141","date":"2026-10-25","epss":0.00395,"percentile":0.3348}],"urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-25","epss":0.00425,"percentile":0.36529}],"risk":0.31875000000000003,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-25","epss":0.00425,"percentile":0.36529}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-25","epss":0.00414,"percentile":0.35461}],"risk":0.31049999999999994,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-25","epss":0.00414,"percentile":0.35461}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.29.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fpg6-x68q-5793","versionConstraint":"<2.29.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-fpg6-x68q-5793","fix":{"state":"fixed","versions":["2.29.8"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.29.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65590","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65590","date":"2026-10-25","epss":0.00584,"percentile":0.47653}],"risk":0.30660000000000004,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793","https://nvd.nist.gov/vuln/detail/CVE-2026-65590","https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8","https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1","https://www.vulncheck.com/advisories/n8n-before-shell-sandbox-bypass-on-linux-windows"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fpg6-x68q-5793","description":"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows"},"relatedVulnerabilities":[{"id":"CVE-2026-65590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65590","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65590","date":"2026-10-25","epss":0.00584,"percentile":0.47653}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793","https://www.vulncheck.com/advisories/n8n-before-shell-sandbox-bypass-on-linux-windows"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65590","description":"n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.24.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x6p3-m6h9-fx7r","versionConstraint":"<2.24.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x6p3-m6h9-fx7r","fix":{"state":"fixed","versions":["2.24.0"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.24.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","metrics":{"baseScore":8.5,"impactScore":4.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54312","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54312","date":"2026-10-25","epss":0.00396,"percentile":0.33487}],"risk":0.30393,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r","https://nvd.nist.gov/vuln/detail/CVE-2026-54312"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x6p3-m6h9-fx7r","description":"n8n: Microsoft SQL Node Prototype Pollution"},"relatedVulnerabilities":[{"id":"CVE-2026-54312","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","metrics":{"baseScore":8.5,"impactScore":4.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54312","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54312","date":"2026-10-25","epss":0.00396,"percentile":0.33487}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54312","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.24.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jqpw-qww5-cj4c","versionConstraint":"<2.24.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jqpw-qww5-cj4c","fix":{"state":"fixed","versions":["2.24.0"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.24.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54314","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54314","date":"2026-10-25","epss":0.00546,"percentile":0.45498}],"risk":0.3030299999999999,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c","https://nvd.nist.gov/vuln/detail/CVE-2026-54314"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jqpw-qww5-cj4c","description":"n8n: Denial of Service via ZIP decompression in webhook workflow"},"relatedVulnerabilities":[{"id":"CVE-2026-54314","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54314","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54314","date":"2026-10-25","epss":0.00546,"percentile":0.45498}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54314","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6218","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6218","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-25","epss":0.0055,"percentile":0.45754}],"risk":0.29975,"urls":["https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/803681","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-56860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-25","epss":0.0055,"percentile":0.45754}],"urls":["https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6218"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9j65-hcg3-gc64","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-9j65-hcg3-gc64","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114143","date":"2026-10-25","epss":0.00365,"percentile":0.30107}],"risk":0.29564999999999997,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://nvd.nist.gov/vuln/detail/CVE-2026-114143","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","description":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114143","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114143","date":"2026-10-25","epss":0.00365,"percentile":0.30107}],"urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.20.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3875-8gcx-7v46","versionConstraint":"<2.20.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3875-8gcx-7v46","fix":{"state":"fixed","versions":["2.20.0"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"2.20.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","metrics":{"baseScore":9.1,"impactScore":5.3,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56348","cwe":"CWE-918","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56348","date":"2026-10-25","epss":0.00482,"percentile":0.41268}],"risk":0.29401999999999995,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46","https://nvd.nist.gov/vuln/detail/CVE-2026-56348","https://www.vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3875-8gcx-7v46","description":"n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-56348","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","metrics":{"baseScore":9.1,"impactScore":5.3,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56348","cwe":"CWE-918","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56348","date":"2026-10-25","epss":0.00482,"percentile":0.41268}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46","https://www.vulncheck.com/advisories/n8n-credential-exfiltration-via-allowed-http-request-domains-bypass-in-dynamic-node-parameters-endpoint"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56348","description":"n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with credentials to unauthorized hosts, exfiltrating sensitive authentication data."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54240","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54240","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54240","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54240","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54240","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54240","date":"2026-10-25","epss":0.00393,"percentile":0.33196}],"risk":0.292785,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54240"},"relatedVulnerabilities":[{"id":"CVE-2026-54240","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54240","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54240","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54240","date":"2026-10-25","epss":0.00393,"percentile":0.33196}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54240","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54241","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54241","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54241","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54241","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54241","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54241","date":"2026-10-25","epss":0.00393,"percentile":0.33196}],"risk":0.292785,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54241"},"relatedVulnerabilities":[{"id":"CVE-2026-54241","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54241","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54241","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54241","date":"2026-10-25","epss":0.00393,"percentile":0.33196}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54241","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch."}]},{"artifact":{"id":"43290accb0c02678","cpes":["cpe:2.3:a:openjsf:body-parser:2.3.0:*:*:*:*:node.js:*:*"],"name":"body-parser","purl":"pkg:npm/body-parser@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/body-parser@2.3.0/node_modules/body-parser/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/body-parser@2.3.0/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":">=2.0.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"body-parser","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-27r3-jxmh-p828","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-111181","date":"2026-10-25","epss":0.00388,"percentile":0.32621}],"risk":0.29100000000000004,"urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body"},"relatedVulnerabilities":[{"id":"CVE-2026-111181","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-111181","date":"2026-10-25","epss":0.00388,"percentile":0.32621}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created."}]},{"artifact":{"id":"ab5593bbdf9ba16a","cpes":["cpe:2.3:a:momentjs:moment:2.30.1:*:*:*:*:node.js:*:*"],"name":"moment","purl":"pkg:npm/moment@2.30.1","type":"npm","version":"2.30.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"moment","version":"2.30.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-25","epss":0.00519,"percentile":0.43857}],"risk":0.282855,"urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","description":"moment vulnerable to Path Traversal via crafted non-string locale name"},"relatedVulnerabilities":[{"id":"CVE-2026-17495","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-25","epss":0.00519,"percentile":0.43857}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale()."}]},{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-32460","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-32460","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32460","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32460","date":"2026-10-25","epss":0.00359,"percentile":0.29444}],"risk":0.2791225,"urls":["https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb","https://issues.oss-fuzz.com/issues/406320404","https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call."},"relatedVulnerabilities":[]},{"artifact":{"id":"d52f342d0f0f1d8c","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22jm-h49p-29qw","versionConstraint":">=1.24.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22jm-h49p-29qw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111767","date":"2026-10-25","epss":0.00345,"percentile":0.2775}],"risk":0.277725,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22jm-h49p-29qw","description":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them"},"relatedVulnerabilities":[{"id":"CVE-2026-111767","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111767","date":"2026-10-25","epss":0.00345,"percentile":0.2775}],"urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0."}]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pph-fpjx-jg34","versionConstraint":">=2.2.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3pph-fpjx-jg34","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-25","epss":0.00532,"percentile":0.44651}],"risk":0.27398,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34","https://nvd.nist.gov/vuln/detail/CVE-2026-88932","https://github.com/expressjs/multer/commit/53337f9713619ef3381ee6b4e541f926dbaac305","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.4.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","description":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads"},"relatedVulnerabilities":[{"id":"CVE-2026-88932","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-25","epss":0.00532,"percentile":0.44651}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","description":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jf52-3f2h-h9j5","versionConstraint":">=0.150.0,<2.2.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jf52-3f2h-h9j5","fix":{"state":"fixed","versions":["2.2.2"],"available":[{"date":"2026-01-08","kind":"first-observed","version":"2.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21894","cwe":"CWE-290","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-21894","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"risk":0.27197499999999997,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5","https://nvd.nist.gov/vuln/detail/CVE-2026-21894","https://github.com/n8n-io/n8n/pull/22764","https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jf52-3f2h-h9j5","description":"n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks"},"relatedVulnerabilities":[{"id":"CVE-2026-21894","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21894","cwe":"CWE-290","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-21894","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"urls":["https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59","https://github.com/n8n-io/n8n/pull/22764","https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21894","description":"n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stripe webhook signing secret when registering the webhook endpoint, but incoming webhook requests were not verified against this secret. As a result, any HTTP client that knows the webhook URL could send a POST request containing a matching event type, causing the workflow to execute as if a legitimate Stripe event had been received. This issue affects n8n users who have active workflows using the Stripe Trigger node. An attacker could potentially fake payment or subscription events and influence downstream workflow behavior. The practical risk is reduced by the fact that the webhook URL contains a high-entropy UUID; however, authenticated n8n users with access to the workflow can view this webhook ID. This issue has been patched in version 2.2.2. A temporary workaround for this issue involves users deactivating affected workflows or restricting access to workflows containing Stripe Trigger nodes to trusted users only."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49346","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49346","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49346","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49346","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49346","date":"2026-10-25","epss":0.00371,"percentile":0.30752}],"risk":0.27082999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49346"},"relatedVulnerabilities":[{"id":"CVE-2026-49346","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49346","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49346","date":"2026-10-25","epss":0.00371,"percentile":0.30752}],"urls":["https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-25","epss":0.0054,"percentile":0.45159}],"risk":0.27,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","description":"qs array-limit bypass via bracket-key comma parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-82562","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-25","epss":0.0054,"percentile":0.45159}],"urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4946","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4946","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-25","epss":0.00355,"percentile":0.28947}],"risk":0.26625,"urls":["https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758061","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."},"relatedVulnerabilities":[{"id":"CVE-2026-32281","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-25","epss":0.00355,"percentile":0.28947}],"urls":["https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4946"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."}]},{"artifact":{"id":"c171089585150323","cpes":["cpe:2.3:a:zod:zod:3.25.67:*:*:*:*:*:*:*"],"name":"zod","purl":"pkg:npm/zod@3.25.67","type":"npm","version":"3.25.67","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/zod@3.25.67/node_modules/zod/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/zod@3.25.67/node_modules/zod/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"zod","version":"3.25.67"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","fix":{"state":"fixed","versions":["4.6.6"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"4.6.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-54404","cwe":"CWE-770","type":"Primary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2023-54404","cwe":"CWE-1188","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-25","epss":0.00346,"percentile":0.27885}],"risk":0.265555,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","description":"Zod can exhaust memory while validating oversized constrained collections"},"relatedVulnerabilities":[{"id":"CVE-2023-54404","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-54404","cwe":"CWE-770","type":"Primary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2023-54404","cwe":"CWE-1188","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-25","epss":0.00346,"percentile":0.27885}],"urls":["https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://github.com/colinhacks/zod/pull/6652","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","description":"Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged."}]},{"artifact":{"id":"ecd3512b2296d0af","cpes":["cpe:2.3:a:nodejs:undici:6.28.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.1","type":"npm","version":"6.28.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:1658735236927f44bf2ff601ca0a76ede69822d0413b2d2710ab6edd4544a3ce","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=6.23.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-25","epss":0.00344,"percentile":0.27642}],"risk":0.258,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-25","epss":0.00344,"percentile":0.27642}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=7.18.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-25","epss":0.00344,"percentile":0.27642}],"risk":0.258,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-25","epss":0.00344,"percentile":0.27642}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"f5deb992baf9d929","cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"name":"postcss","purl":"pkg:npm/postcss@8.5.6","type":"npm","version":"8.5.6","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.5.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss","version":"8.5.6"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","fix":{"state":"fixed","versions":["8.5.23"],"available":[{"date":"2026-08-04","kind":"first-observed","version":"8.5.23"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-69153","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69153","date":"2026-10-25","epss":0.00451,"percentile":0.38922}],"risk":0.254815,"urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset"},"relatedVulnerabilities":[{"id":"CVE-2026-69153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-69153","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69153","date":"2026-10-25","epss":0.00451,"percentile":0.38922}],"urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19."}]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6gq-j5cr-w38f","versionConstraint":"<=9.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-p6gq-j5cr-w38f","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82659","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82659","date":"2026-10-25","epss":0.00349,"percentile":0.28208}],"risk":0.25477,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-68x8-4h5v-r533","https://nvd.nist.gov/vuln/detail/CVE-2026-82659","https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2","https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6gq-j5cr-w38f","description":"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message"},"relatedVulnerabilities":[{"id":"CVE-2026-82659","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82659","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82659","date":"2026-10-25","epss":0.00349,"percentile":0.28208}],"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82659","description":"nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45382","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45382","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-45382","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45382","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45382","date":"2026-10-25","epss":0.00428,"percentile":0.36764}],"risk":0.25466,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-45382"},"relatedVulnerabilities":[{"id":"CVE-2026-45382","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45382","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45382","date":"2026-10-25","epss":0.00428,"percentile":0.36764}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45382","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue."}]},{"artifact":{"id":"c959f930c48fe08f","cpes":["cpe:2.3:a:\\@langchain\\/mongodb:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/mongodb","purl":"pkg:npm/%40langchain/mongodb@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.1.8_@o_808b4e7270fc40e6f5157dfe807f2194/node_modules/@langchain/mongodb/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.1.8_@o_808b4e7270fc40e6f5157dfe807f2194/node_modules/@langchain/mongodb/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6rx-h84q-8r95","versionConstraint":"<=1.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/mongodb","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m6rx-h84q-8r95","fix":{"state":"fixed","versions":["1.3.1"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"1.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-25","epss":0.00463,"percentile":0.39881}],"risk":0.25465000000000004,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","https://nvd.nist.gov/vuln/detail/CVE-2026-106119","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","description":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"},"relatedVulnerabilities":[{"id":"CVE-2026-106119","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-25","epss":0.00463,"percentile":0.39881}],"urls":["https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45383","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45383","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-45383","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45383","date":"2026-10-25","epss":0.00426,"percentile":0.36553}],"risk":0.25347,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-45383"},"relatedVulnerabilities":[{"id":"CVE-2026-45383","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45383","date":"2026-10-25","epss":0.00426,"percentile":0.36553}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45383","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue."}]},{"artifact":{"id":"90b2fe63ad4df1bf","cpes":["cpe:2.3:a:\\@simple-git\\/argv-parser:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv-parser:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv_parser:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv_parser:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*"],"name":"@simple-git/argv-parser","purl":"pkg:npm/%40simple-git/argv-parser@1.1.1","type":"npm","version":"1.1.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@simple-git+argv-parser@1.1.1/node_modules/@simple-git/argv-parser/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@simple-git+argv-parser@1.1.1/node_modules/@simple-git/argv-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v5rq-49vh-5v5c","versionConstraint":"<2.0.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@simple-git/argv-parser","version":"1.1.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v5rq-49vh-5v5c","fix":{"state":"fixed","versions":["2.0.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"2.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102829","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102829","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102829","date":"2026-10-25","epss":0.00275,"percentile":0.19724}],"risk":0.25025,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c","https://nvd.nist.gov/vuln/detail/CVE-2026-102829","https://github.com/steveukx/git-js/pull/1201","https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4","https://github.com/steveukx/git-js/releases/tag/@simple-git/argv-parser@2.0.1"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v5rq-49vh-5v5c","description":"simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection"},"relatedVulnerabilities":[{"id":"CVE-2026-102829","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102829","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102829","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102829","date":"2026-10-25","epss":0.00275,"percentile":0.19724}],"urls":["https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4","https://github.com/steveukx/git-js/pull/1201","https://github.com/steveukx/git-js/releases/tag/@simple-git/argv-parser@2.0.1","https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102829","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49295","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49295","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49295","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49295","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49295","date":"2026-10-25","epss":0.00338,"percentile":0.26972}],"risk":0.24674000000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49295"},"relatedVulnerabilities":[{"id":"CVE-2026-49295","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49295","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49295","date":"2026-10-25","epss":0.00338,"percentile":0.26972}],"urls":["https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b","https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49295","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-35jj-42hp-8gmq","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-35jj-42hp-8gmq","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-11","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86077","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86077","date":"2026-10-25","epss":0.00432,"percentile":0.37137}],"risk":0.24408,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-35jj-42hp-8gmq","https://nvd.nist.gov/vuln/detail/CVE-2026-86077","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-35jj-42hp-8gmq","description":"n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket"},"relatedVulnerabilities":[{"id":"CVE-2026-86077","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86077","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86077","date":"2026-10-25","epss":0.00432,"percentile":0.37137}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-35jj-42hp-8gmq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86077","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v2v4-37r5-5v8g","versionConstraint":"<=10.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v2v4-37r5-5v8g","fix":{"state":"fixed","versions":["10.1.1"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"10.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42338","cwe":"CWE-79","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42338","date":"2026-10-25","epss":0.00471,"percentile":0.40451}],"risk":0.242565,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://nvd.nist.gov/vuln/detail/CVE-2026-42338"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v2v4-37r5-5v8g","description":"ip-address has XSS in Address6 HTML-emitting methods"},"relatedVulnerabilities":[{"id":"CVE-2026-42338","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42338","cwe":"CWE-79","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42338","date":"2026-10-25","epss":0.00471,"percentile":0.40451}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:35841","https://access.redhat.com/errata/RHSA-2026:35842","https://access.redhat.com/errata/RHSA-2026:35891","https://access.redhat.com/errata/RHSA-2026:35892","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:39246","https://access.redhat.com/errata/RHSA-2026:39868","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41947","https://access.redhat.com/errata/RHSA-2026:44237","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:51200","https://access.redhat.com/errata/RHSA-2026:52399","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62335","https://access.redhat.com/errata/RHSA-2026:62336","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42338","https://bugzilla.redhat.com/show_bug.cgi?id=2476810","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cqr2-h44g-v75v","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cqr2-h44g-v75v","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-11","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86085","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86085","date":"2026-10-25","epss":0.00444,"percentile":0.38382}],"risk":0.22422000000000003,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v","https://nvd.nist.gov/vuln/detail/CVE-2026-86085","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cqr2-h44g-v75v","description":"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints"},"relatedVulnerabilities":[{"id":"CVE-2026-86085","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86085","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86085","date":"2026-10-25","epss":0.00444,"percentile":0.38382}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86085","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.29.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5xf-xhwf-cwqf","versionConstraint":"<2.29.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q5xf-xhwf-cwqf","fix":{"state":"fixed","versions":["2.29.8"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.29.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65594","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65594","date":"2026-10-25","epss":0.0044,"percentile":0.37989}],"risk":0.2222,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf","https://nvd.nist.gov/vuln/detail/CVE-2026-65594","https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8","https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1","https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5xf-xhwf-cwqf","description":"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check"},"relatedVulnerabilities":[{"id":"CVE-2026-65594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65594","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65594","date":"2026-10-25","epss":0.0044,"percentile":0.37989}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf","https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65594","description":"n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f3f2-mcxc-pwjx","versionConstraint":"<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-f3f2-mcxc-pwjx","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56351","cwe":"CWE-89","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56351","date":"2026-10-25","epss":0.00375,"percentile":0.31221}],"risk":0.22031249999999997,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx","https://github.com/n8n-io/n8n/commit/f73fae6fe7fc34907bba102648a9997186aa4385","https://github.com/n8n-io/n8n/releases/tag/n8n%402.4.0","https://nvd.nist.gov/vuln/detail/CVE-2026-56351","https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-postgresql-and-microsoft-sql-nodes"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f3f2-mcxc-pwjx","description":"n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes"},"relatedVulnerabilities":[{"id":"CVE-2026-56351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56351","cwe":"CWE-89","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56351","date":"2026-10-25","epss":0.00375,"percentile":0.31221}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx","https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-postgresql-and-microsoft-sql-nodes"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56351","description":"n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity."}]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-39m8-27wv-hr27","versionConstraint":">=3.0.0,<=10.0.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-39m8-27wv-hr27","fix":{"state":"fixed","versions":["10.0.10"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.0.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110871","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-110871","date":"2026-10-25","epss":0.00381,"percentile":0.31775}],"risk":0.219075,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://nvd.nist.gov/vuln/detail/CVE-2026-110871","https://github.com/nodemailer/nodemailer/commit/28a5909cec27646cb001dc7e97a8f5d26c973078","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-39m8-27wv-hr27","description":"Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing"},"relatedVulnerabilities":[{"id":"CVE-2026-110871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110871","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-110871","date":"2026-10-25","epss":0.00381,"percentile":0.31775}],"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110871","description":"Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-25","epss":0.00386,"percentile":0.3238}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-25","epss":0.00386,"percentile":0.3238}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9c38-2mcm-q7f7","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-9c38-2mcm-q7f7","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.3,"impactScore":4,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54311","cwe":"CWE-488","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54311","date":"2026-10-25","epss":0.00391,"percentile":0.3299}],"risk":0.21798250000000002,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7","https://nvd.nist.gov/vuln/detail/CVE-2026-54311"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9c38-2mcm-q7f7","description":"n8n: Merge Node SQL Mode Prototype Pollution"},"relatedVulnerabilities":[{"id":"CVE-2026-54311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.7,"impactScore":4,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54311","cwe":"CWE-488","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54311","date":"2026-10-25","epss":0.00391,"percentile":0.3299}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54311","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL executions belonging to other users or projects. This allowed a low-privileged attacker to intercept workflow data processed by other users on the same instance. This issue only affects multi-user n8n instances where more than one user has permission to create and execute workflows containing the Merge node in SQL Query mode. This vulnerability is fixed in 2.25.7 and 2.26.2."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-25","epss":0.00383,"percentile":0.32061}],"risk":0.216395,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-25","epss":0.00383,"percentile":0.32061}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-25","epss":0.00396,"percentile":0.33515}],"risk":0.21384,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","description":"qs: Denial of Service via Attacker Controlled isBuffer"},"relatedVulnerabilities":[{"id":"CVE-2026-82417","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-25","epss":0.00396,"percentile":0.33515}],"urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cw9w-vv67-hf73","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cw9w-vv67-hf73","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-11","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86073","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86073","date":"2026-10-25","epss":0.0039,"percentile":0.328}],"risk":0.21255000000000002,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73","https://nvd.nist.gov/vuln/detail/CVE-2026-86073","https://github.com/n8n-io/n8n/pull/37122","https://github.com/n8n-io/n8n/pull/37588","https://github.com/n8n-io/n8n/commit/18458482861097a26f874f30ad7e8136e268475c","https://github.com/n8n-io/n8n/commit/380788fd9a3264c83161e868026a98731d274d88","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cw9w-vv67-hf73","description":"n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-86073","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86073","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86073","date":"2026-10-25","epss":0.0039,"percentile":0.328}],"urls":["https://github.com/n8n-io/n8n/commit/18458482861097a26f874f30ad7e8136e268475c","https://github.com/n8n-io/n8n/commit/380788fd9a3264c83161e868026a98731d274d88","https://github.com/n8n-io/n8n/pull/37122","https://github.com/n8n-io/n8n/pull/37588","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.1","https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86073","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-25","epss":0.0037,"percentile":0.30699}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-25","epss":0.0037,"percentile":0.30699}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.24.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jpq7-226w-6cxx","versionConstraint":"<2.24.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jpq7-226w-6cxx","fix":{"state":"fixed","versions":["2.24.0"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.24.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.7,"impactScore":4,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","metrics":{"baseScore":6.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54313","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54313","date":"2026-10-25","epss":0.00343,"percentile":0.27589}],"risk":0.207515,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx","https://nvd.nist.gov/vuln/detail/CVE-2026-54313"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jpq7-226w-6cxx","description":"n8n: NoSQL Injection in MongoDB Node Find And Replace Operation"},"relatedVulnerabilities":[{"id":"CVE-2026-54313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.7,"impactScore":4,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54313","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54313","date":"2026-10-25","epss":0.00343,"percentile":0.27589}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54313","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0."}]},{"artifact":{"id":"bfb76f0c1a67f745","cpes":["cpe:2.3:a:\\@opentelemetry\\/core:\\@opentelemetry\\/core:1.30.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/core:1.30.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/core","purl":"pkg:npm/%40opentelemetry/core@1.30.1","type":"npm","version":"1.30.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+core@1.30.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/core/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+core@1.30.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/core/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8988-4f7v-96qf","versionConstraint":"<2.8.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/core","version":"1.30.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8988-4f7v-96qf","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54285","date":"2026-10-25","epss":0.00402,"percentile":0.34193}],"risk":0.20703000000000002,"urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf","https://nvd.nist.gov/vuln/detail/CVE-2026-54285"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8988-4f7v-96qf","description":"OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation"},"relatedVulnerabilities":[{"id":"CVE-2026-54285","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54285","date":"2026-10-25","epss":0.00402,"percentile":0.34193}],"urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54285","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4980","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4980","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-25","epss":0.00371,"percentile":0.30774}],"risk":0.20590499999999998,"urls":["https://go.dev/cl/771180","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78981","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."},"relatedVulnerabilities":[{"id":"CVE-2026-39826","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-25","epss":0.00371,"percentile":0.30774}],"urls":["https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4980"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2434-3x6q-8r99","versionConstraint":"<2.27.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2434-3x6q-8r99","fix":{"state":"fixed","versions":["2.27.4"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.27.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59254","cwe":"CWE-639","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59254","date":"2026-10-25","epss":0.00364,"percentile":0.29998}],"risk":0.20566,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2434-3x6q-8r99","https://nvd.nist.gov/vuln/detail/CVE-2026-59254","https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1","https://www.vulncheck.com/advisories/n8n-external-secrets-disclosure-via-workflow-node-expressions"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2434-3x6q-8r99","description":"n8n: External Secrets Accessible via Workflow Expressions Outside Credentials"},"relatedVulnerabilities":[{"id":"CVE-2026-59254","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59254","cwe":"CWE-639","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59254","date":"2026-10-25","epss":0.00364,"percentile":0.29998}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2434-3x6q-8r99","https://www.vulncheck.com/advisories/n8n-external-secrets-disclosure-via-workflow-node-expressions"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59254","description":"n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q5wm-mgqx-fv2f","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q5wm-mgqx-fv2f","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-11","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86074","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86074","date":"2026-10-25","epss":0.00376,"percentile":0.31279}],"risk":0.20492000000000002,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f","https://nvd.nist.gov/vuln/detail/CVE-2026-86074","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q5wm-mgqx-fv2f","description":"n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content"},"relatedVulnerabilities":[{"id":"CVE-2026-86074","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86074","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86074","date":"2026-10-25","epss":0.00376,"percentile":0.31279}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86074","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-25","epss":0.00428,"percentile":0.36796}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4976","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4976","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-25","epss":0.0039,"percentile":0.32884}],"risk":0.20084999999999997,"urls":["https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/770541","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."},"relatedVulnerabilities":[{"id":"CVE-2026-39825","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-25","epss":0.0039,"percentile":0.32884}],"urls":["https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4976"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mq3m-f8x3-579w","versionConstraint":"<2.27.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mq3m-f8x3-579w","fix":{"state":"fixed","versions":["2.27.4"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.27.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59208","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59208","cwe":"CWE-346","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59208","cwe":"CWE-346","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-59208","date":"2026-10-25","epss":0.00265,"percentile":0.18237}],"risk":0.200075,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w","https://nvd.nist.gov/vuln/detail/CVE-2026-59208","https://github.com/n8n-io/n8n/releases/tag/n8n@2.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mq3m-f8x3-579w","description":"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-59208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59208","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59208","cwe":"CWE-346","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-59208","cwe":"CWE-346","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-59208","date":"2026-10-25","epss":0.00265,"percentile":0.18237}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4","https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1","https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59208","description":"n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5856","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5856","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-25","epss":0.00382,"percentile":0.31958}],"risk":0.19673,"urls":["https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/775960","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."},"relatedVulnerabilities":[{"id":"CVE-2026-42505","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-25","epss":0.00382,"percentile":0.31958}],"urls":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-5856"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42505","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j4p8-h8mh-rh8q","versionConstraint":">=1.2.1,<2.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j4p8-h8mh-rh8q","fix":{"state":"fixed","versions":["2.0.0"],"available":[{"date":"2025-12-27","kind":"first-observed","version":"2.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68697","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-68697","cwe":"CWE-749","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68697","date":"2026-10-25","epss":0.00265,"percentile":0.18273}],"risk":0.19345,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q","https://nvd.nist.gov/vuln/detail/CVE-2025-68697"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j4p8-h8mh-rh8q","description":"Self-hosted n8n has Legacy Code node that enables arbitrary file read/write"},"relatedVulnerabilities":[{"id":"CVE-2025-68697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68697","cwe":"CWE-269","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-68697","cwe":"CWE-749","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68697","date":"2026-10-25","epss":0.00265,"percentile":0.18273}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68697","description":"n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5039","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5039","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-25","epss":0.0037,"percentile":0.3069}],"risk":0.19055,"urls":["https://go.dev/cl/777060","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79346","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."},"relatedVulnerabilities":[{"id":"CVE-2026-42507","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-25","epss":0.0037,"percentile":0.3069}],"urls":["https://go.dev/cl/777060","https://go.dev/issue/79346","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5039"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4603","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4603","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-25","epss":0.00341,"percentile":0.27333}],"risk":0.18925499999999998,"urls":["https://go.dev/issue/77954","https://go.dev/cl/752081"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\".\n\nA new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."},"relatedVulnerabilities":[{"id":"CVE-2026-27142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-25","epss":0.00341,"percentile":0.27333}],"urls":["https://go.dev/cl/752081","https://go.dev/issue/77954","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4603"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."}]},{"artifact":{"id":"b686b25c707ad483","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.5:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.5:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.5","type":"npm","version":"2.17.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.17.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jxwj-j7wr-gfrw","versionConstraint":"<=2.17.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jxwj-j7wr-gfrw","fix":{"state":"fixed","versions":["2.17.6"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"2.17.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63670","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63670","date":"2026-10-25","epss":0.00327,"percentile":0.25545}],"risk":0.18148499999999998,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw","https://nvd.nist.gov/vuln/detail/CVE-2026-63670","https://github.com/apostrophecms/apostrophe/pull/5501","https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jxwj-j7wr-gfrw","description":"ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close"},"relatedVulnerabilities":[{"id":"CVE-2026-63670","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63670","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63670","date":"2026-10-25","epss":0.00327,"percentile":0.25545}],"urls":["https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725","https://github.com/apostrophecms/apostrophe/pull/5501","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63670","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22g5-r2x5-97cx","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22g5-r2x5-97cx","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-25","epss":0.00338,"percentile":0.26963}],"risk":0.18083,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59710","https://github.com/showdownjs/showdown/issues/1046","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22g5-r2x5-97cx","description":"showdown allows stored cross-site scripting through table header ID injection"},"relatedVulnerabilities":[{"id":"CVE-2026-59710","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-25","epss":0.00338,"percentile":0.26963}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown/issues/1046","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59710","description":"showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration."}]},{"artifact":{"id":"b686b25c707ad483","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.5:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.5:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.5","type":"npm","version":"2.17.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x3q4-9hxx-gx8m","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x3q4-9hxx-gx8m","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113654","date":"2026-10-25","epss":0.00349,"percentile":0.28202}],"risk":0.179735,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","description":"ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render"},"relatedVulnerabilities":[{"id":"CVE-2026-113654","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113654","date":"2026-10-25","epss":0.00349,"percentile":0.28202}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113654","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"3f40c4414d282169","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.1.0","type":"npm","version":"10.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.1.0/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","fix":{"state":"fixed","versions":["10.7.4"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"risk":0.177975,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"},"relatedVulnerabilities":[{"id":"CVE-2026-111997","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."}]},{"artifact":{"id":"cd18d43b0cb2b261","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.7.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.7.1","type":"npm","version":"10.7.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:1658735236927f44bf2ff601ca0a76ede69822d0413b2d2710ab6edd4544a3ce","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.7.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","fix":{"state":"fixed","versions":["10.7.4"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"risk":0.177975,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"},"relatedVulnerabilities":[{"id":"CVE-2026-111997","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."}]},{"artifact":{"id":"ce7f33861b65357b","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.7.2:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.7.2","type":"npm","version":"10.7.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.7.2/node_modules/ip-address/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.7.2/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.7.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","fix":{"state":"fixed","versions":["10.7.4"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"risk":0.177975,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"},"relatedVulnerabilities":[{"id":"CVE-2026-111997","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-25","epss":0.00315,"percentile":0.24136}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4970","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4970","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-25","epss":0.00232,"percentile":0.13988}],"risk":0.17748,"urls":["https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79005","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."},"relatedVulnerabilities":[{"id":"CVE-2026-39822","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-25","epss":0.00232,"percentile":0.13988}],"urls":["https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-4970"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jvc7-762p-3743","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jvc7-762p-3743","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54308","cwe":"CWE-290","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54308","date":"2026-10-25","epss":0.00299,"percentile":0.22367}],"risk":0.17566250000000003,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743","https://nvd.nist.gov/vuln/detail/CVE-2026-54308"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jvc7-762p-3743","description":"n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes"},"relatedVulnerabilities":[{"id":"CVE-2026-54308","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54308","cwe":"CWE-290","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54308","date":"2026-10-25","epss":0.00299,"percentile":0.22367}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54308","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2."}]},{"artifact":{"id":"ecd3512b2296d0af","cpes":["cpe:2.3:a:nodejs:undici:6.28.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.1","type":"npm","version":"6.28.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:1658735236927f44bf2ff601ca0a76ede69822d0413b2d2710ab6edd4544a3ce","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=6.5.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-25","epss":0.00321,"percentile":0.24857}],"risk":0.17494500000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"},"relatedVulnerabilities":[{"id":"CVE-2026-109924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-25","epss":0.00321,"percentile":0.24857}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-25","epss":0.00321,"percentile":0.24857}],"risk":0.17494500000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"},"relatedVulnerabilities":[{"id":"CVE-2026-109924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-25","epss":0.00321,"percentile":0.24857}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cr32-g25g-vxjj","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cr32-g25g-vxjj","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-25","epss":0.00327,"percentile":0.25543}],"risk":0.17494499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59711","https://github.com/showdownjs/showdown/issues/1047","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument","https://github.com/showdownjs/showdown/commit/184a3e4e97f90e075c4512f2c4c06dcf655e91b7"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cr32-g25g-vxjj","description":"showdown metadata title handling allows cross-site scripting"},"relatedVulnerabilities":[{"id":"CVE-2026-59711","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-25","epss":0.00327,"percentile":0.25543}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/issues/1047","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59711","description":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4982","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4982","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-25","epss":0.00314,"percentile":0.24117}],"risk":0.17426999999999998,"urls":["https://go.dev/cl/769920","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78913","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-39823","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-25","epss":0.00314,"percentile":0.24117}],"urls":["https://go.dev/cl/769920","https://go.dev/issue/78913","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4982"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39823","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."}]},{"artifact":{"id":"7dea407be1b52747","cpes":["cpe:2.3:a:sindresorhus:file-type:16.5.4:*:*:*:*:node.js:*:*"],"name":"file-type","purl":"pkg:npm/file-type@16.5.4","type":"npm","version":"16.5.4","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/file-type@16.5.4/node_modules/file-type/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/file-type@16.5.4/node_modules/file-type/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"21.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5v7r-6r5c-r473","versionConstraint":">=13.0.0,<21.3.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"file-type","version":"16.5.4"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5v7r-6r5c-r473","fix":{"state":"fixed","versions":["21.3.1"],"available":[{"date":"2026-03-11","kind":"first-observed","version":"21.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31808","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-31808","date":"2026-10-25","epss":0.00337,"percentile":0.26918}],"risk":0.17355500000000001,"urls":["https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473","https://nvd.nist.gov/vuln/detail/CVE-2026-31808","https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5v7r-6r5c-r473","description":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header"},"relatedVulnerabilities":[{"id":"CVE-2026-31808","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31808","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-31808","date":"2026-10-25","epss":0.00337,"percentile":0.26918}],"urls":["https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f","https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31808","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6091","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6091","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-25","epss":0.0031,"percentile":0.2357}],"risk":0.17204999999999998,"urls":["https://go.dev/cl/807100","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80435","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-56858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-25","epss":0.0031,"percentile":0.2357}],"urls":["https://go.dev/cl/807100","https://go.dev/issue/80435","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4864","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4864","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-25","epss":0.00292,"percentile":0.21519}],"risk":0.16644,"urls":["https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763761","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."},"relatedVulnerabilities":[{"id":"CVE-2026-32282","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-25","epss":0.00292,"percentile":0.21519}],"urls":["https://go.dev/cl/763761","https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4864"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4865","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4865","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-25","epss":0.0029,"percentile":0.21364}],"risk":0.16094999999999995,"urls":["https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763762","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2026-32289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-25","epss":0.0029,"percentile":0.21364}],"urls":["https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4865"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6599","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6599","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"risk":0.160395,"urls":["https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/839866","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-94448","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"urls":["https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6599"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6600","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6600","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"risk":0.160395,"urls":["https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/840925","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-97030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"urls":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."}]},{"artifact":{"id":"afbf437379fbbc06","cpes":["cpe:2.3:a:hono:hono:4.13.5:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.13.5","type":"npm","version":"4.13.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.13.5/node_modules/hono/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.13.5/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5r4p-p66f-jhc7","versionConstraint":">=4.12.4,<4.13.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.13.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","fix":{"state":"fixed","versions":["4.13.11"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"4.13.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-25","epss":0.0031,"percentile":0.23621}],"risk":0.15965000000000001,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","https://nvd.nist.gov/vuln/detail/CVE-2026-111757","https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/releases/tag/v4.13.11"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths"},"relatedVulnerabilities":[{"id":"CVE-2026-111757","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-25","epss":0.0031,"percentile":0.23621}],"urls":["https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-43v7-fp2v-68f6","versionConstraint":"<2.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-43v7-fp2v-68f6","fix":{"state":"fixed","versions":["2.5.0"],"available":[{"date":"2026-03-26","kind":"first-observed","version":"2.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33724","cwe":"CWE-639","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33724","date":"2026-10-25","epss":0.00293,"percentile":0.21717}],"risk":0.1589525,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6","https://nvd.nist.gov/vuln/detail/CVE-2026-33724"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-43v7-fp2v-68f6","description":"n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no"},"relatedVulnerabilities":[{"id":"CVE-2026-33724","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33724","cwe":"CWE-639","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33724","date":"2026-10-25","epss":0.00293,"percentile":0.21717}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33724","description":"n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for git operations explicitly disabled host key verification. A network attacker positioned between the n8n instance and the remote Git server could intercept the connection and present a fraudulent host key, potentially injecting malicious content into workflows or intercepting repository data. This issue only affects instances where the Source Control feature has been explicitly enabled and configured to use SSH (non-default). The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Disable the Source Control feature if it is not actively required, and/or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}]},{"artifact":{"id":"b686b25c707ad483","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.5:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.5:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.5","type":"npm","version":"2.17.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.17.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g8qq-57p8-ggw5","versionConstraint":">=1.9.0,<=2.17.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g8qq-57p8-ggw5","fix":{"state":"fixed","versions":["2.17.7"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"2.17.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84371","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84371","date":"2026-10-25","epss":0.00298,"percentile":0.22309}],"risk":0.15496000000000001,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5","https://github.com/apostrophecms/apostrophe/pull/5552","https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081","https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949","https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g8qq-57p8-ggw5","description":"ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-84371","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84371","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84371","date":"2026-10-25","epss":0.00298,"percentile":0.22309}],"urls":["https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md","https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081","https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949","https://github.com/apostrophecms/apostrophe/pull/5552","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84371","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w96v-gf22-crwp","versionConstraint":">=1.36.0,<2.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-w96v-gf22-crwp","fix":{"state":"fixed","versions":["2.2.0"],"available":[{"date":"2026-01-14","kind":"first-observed","version":"2.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68949","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-68949","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68949","date":"2026-10-25","epss":0.003,"percentile":0.22512}],"risk":0.15450000000000003,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp","https://github.com/n8n-io/n8n/issues/23399","https://github.com/n8n-io/n8n/pull/23399","https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5","https://nvd.nist.gov/vuln/detail/CVE-2025-68949"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w96v-gf22-crwp","description":"n8n: Webhook Node IP Whitelist Bypass via Partial String Matching"},"relatedVulnerabilities":[{"id":"CVE-2025-68949","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68949","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-68949","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68949","date":"2026-10-25","epss":0.003,"percentile":0.22512}],"urls":["https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5","https://github.com/n8n-io/n8n/issues/23399","https://github.com/n8n-io/n8n/pull/23399","https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68949","description":"n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring. This issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary. This vulnerability is fixed in 2.2.0."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4869","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4869","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-25","epss":0.0029,"percentile":0.21362}],"risk":0.15225,"urls":["https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763766","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."},"relatedVulnerabilities":[{"id":"CVE-2026-32288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-25","epss":0.0029,"percentile":0.21362}],"urls":["https://go.dev/cl/763766","https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4869"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32288","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49337","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49337","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49337","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49337","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49337","date":"2026-10-25","epss":0.00327,"percentile":0.25594}],"risk":0.152055,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49337"},"relatedVulnerabilities":[{"id":"CVE-2026-49337","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49337","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49337","date":"2026-10-25","epss":0.00327,"percentile":0.25594}],"urls":["https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9","https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49337","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object\nthat has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vff-hj5x-8gq7","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vff-hj5x-8gq7","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54306","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54306","date":"2026-10-25","epss":0.0028,"percentile":0.20245}],"risk":0.1519,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7","https://nvd.nist.gov/vuln/detail/CVE-2026-54306"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vff-hj5x-8gq7","description":"n8n: Prototype Pollution enables confused-deputy execution via public webhooks"},"relatedVulnerabilities":[{"id":"CVE-2026-54306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54306","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54306","date":"2026-10-25","epss":0.0028,"percentile":0.20245}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54306","description":"n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.37.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hgx-277f-7vmg","versionConstraint":"<2.37.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-7hgx-277f-7vmg","fix":{"state":"fixed","versions":["2.37.7"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"2.37.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86996","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86996","date":"2026-10-25","epss":0.00294,"percentile":0.21828}],"risk":0.15141,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-7hgx-277f-7vmg","https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hgx-277f-7vmg","description":"n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy"},"relatedVulnerabilities":[{"id":"CVE-2026-86996","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86996","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86996","date":"2026-10-25","epss":0.00294,"percentile":0.21828}],"urls":["https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-7hgx-277f-7vmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86996","description":"n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-25","epss":0.00299,"percentile":0.22362}],"risk":0.1495,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-25","epss":0.00299,"percentile":0.22362}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"risk":0.1485,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.28.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2xgm-wc4g-5jvg","versionConstraint":"<2.28.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2xgm-wc4g-5jvg","fix":{"state":"fixed","versions":["2.28.0"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.28.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59253","cwe":"CWE-639","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59253","date":"2026-10-25","epss":0.0028,"percentile":0.20247}],"risk":0.1442,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg","https://nvd.nist.gov/vuln/detail/CVE-2026-59253","https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.0","https://www.vulncheck.com/advisories/n8n-improper-authorization-in-workflow-assignment-to-folders"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2xgm-wc4g-5jvg","description":"n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects"},"relatedVulnerabilities":[{"id":"CVE-2026-59253","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59253","cwe":"CWE-639","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59253","date":"2026-10-25","epss":0.0028,"percentile":0.20247}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg","https://www.vulncheck.com/advisories/n8n-improper-authorization-in-workflow-assignment-to-folders"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59253","description":"n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures."}]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7g4-qg5f-qqm2","versionConstraint":"<=8.0.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r7g4-qg5f-qqm2","fix":{"state":"fixed","versions":["8.0.8"],"available":[{"date":"2026-06-15","kind":"first-observed","version":"8.0.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82662","cwe":"CWE-295","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82662","date":"2026-10-25","epss":0.00192,"percentile":0.08785}],"risk":0.14304,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2","https://nvd.nist.gov/vuln/detail/CVE-2026-82662","https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7g4-qg5f-qqm2","description":"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception"},"relatedVulnerabilities":[{"id":"CVE-2026-82662","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82662","cwe":"CWE-295","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82662","date":"2026-10-25","epss":0.00192,"percentile":0.08785}],"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2","https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82662","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"risk":0.14100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.24.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h86q-fx34-gfjr","versionConstraint":"<2.24.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h86q-fx34-gfjr","fix":{"state":"fixed","versions":["2.24.0"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.24.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54303","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54303","date":"2026-10-25","epss":0.00231,"percentile":0.13809}],"risk":0.14090999999999998,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr","https://nvd.nist.gov/vuln/detail/CVE-2026-54303"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h86q-fx34-gfjr","description":"n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints"},"relatedVulnerabilities":[{"id":"CVE-2026-54303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54303","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54303","date":"2026-10-25","epss":0.00231,"percentile":0.13809}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54303","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0."}]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106444","date":"2026-10-25","epss":0.0029,"percentile":0.21383}],"risk":0.14064999999999997,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates"},"relatedVulnerabilities":[{"id":"CVE-2026-106444","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106444","date":"2026-10-25","epss":0.0029,"percentile":0.21383}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"risk":0.13949999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110306","cwe":"CWE-180","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110306","date":"2026-10-25","epss":0.0025,"percentile":0.16142}],"risk":0.13874999999999998,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding"},"relatedVulnerabilities":[{"id":"CVE-2026-110306","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110306","cwe":"CWE-180","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110306","date":"2026-10-25","epss":0.0025,"percentile":0.16142}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f72v-6w45-q472","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-f72v-6w45-q472","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109841","date":"2026-10-25","epss":0.00252,"percentile":0.16469}],"risk":0.13734000000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f72v-6w45-q472","description":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens"},"relatedVulnerabilities":[{"id":"CVE-2026-109841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109841","date":"2026-10-25","epss":0.00252,"percentile":0.16469}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata."}]},{"artifact":{"id":"b686b25c707ad483","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.5:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.5:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.5","type":"npm","version":"2.17.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.5/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cv27-6wvh-8x7j","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cv27-6wvh-8x7j","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113661","date":"2026-10-25","epss":0.00263,"percentile":0.17929}],"risk":0.13676,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","description":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs"},"relatedVulnerabilities":[{"id":"CVE-2026-113661","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113661","date":"2026-10-25","epss":0.00263,"percentile":0.17929}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113661","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"d2d480ff614f0c15","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-knex:\\@opentelemetry\\/instrumentation-knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-knex:\\@opentelemetry\\/instrumentation_knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_knex:\\@opentelemetry\\/instrumentation-knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_knex:\\@opentelemetry\\/instrumentation_knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-knex:0.44.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_knex:0.44.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-knex","purl":"pkg:npm/%40opentelemetry/instrumentation-knex@0.44.1","type":"npm","version":"0.44.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-knex@0.44.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-knex/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-knex@0.44.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-knex/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.65.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.65.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-knex","version":"0.44.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.65.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.65.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"e780d5e95b511df4","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-mongoose:\\@opentelemetry\\/instrumentation-mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-mongoose:\\@opentelemetry\\/instrumentation_mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mongoose:\\@opentelemetry\\/instrumentation-mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mongoose:\\@opentelemetry\\/instrumentation_mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-mongoose:0.46.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_mongoose:0.46.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-mongoose","purl":"pkg:npm/%40opentelemetry/instrumentation-mongoose@0.46.1","type":"npm","version":"0.46.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mongoose@0.46.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mongoose/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mongoose@0.46.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mongoose/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.67.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.67.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-mongoose","version":"0.46.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.67.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.67.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"f176d540707946c0","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-mysql:\\@opentelemetry\\/instrumentation-mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-mysql:\\@opentelemetry\\/instrumentation_mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mysql:\\@opentelemetry\\/instrumentation-mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mysql:\\@opentelemetry\\/instrumentation_mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-mysql:0.45.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_mysql:0.45.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-mysql","purl":"pkg:npm/%40opentelemetry/instrumentation-mysql@0.45.1","type":"npm","version":"0.45.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mysql@0.45.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mysql/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mysql@0.45.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mysql/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.67.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.67.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-mysql","version":"0.45.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.67.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.67.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"1d68e8a989cae04a","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-mysql2:\\@opentelemetry\\/instrumentation-mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-mysql2:\\@opentelemetry\\/instrumentation_mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mysql2:\\@opentelemetry\\/instrumentation-mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_mysql2:\\@opentelemetry\\/instrumentation_mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-mysql2:0.45.2:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_mysql2:0.45.2:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-mysql2","purl":"pkg:npm/%40opentelemetry/instrumentation-mysql2@0.45.2","type":"npm","version":"0.45.2","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mysql2@0.45.2_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mysql2/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-mysql2@0.45.2_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-mysql2/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.67.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.67.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-mysql2","version":"0.45.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.67.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.67.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"3b9f753876293a2e","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-pg:\\@opentelemetry\\/instrumentation-pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-pg:\\@opentelemetry\\/instrumentation_pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_pg:\\@opentelemetry\\/instrumentation-pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_pg:\\@opentelemetry\\/instrumentation_pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-pg:0.51.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_pg:0.51.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-pg","purl":"pkg:npm/%40opentelemetry/instrumentation-pg@0.51.1","type":"npm","version":"0.51.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-pg@0.51.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-pg/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-pg@0.51.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-pg/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.73.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.73.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-pg","version":"0.51.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.73.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.73.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"232d6029fd2a3210","cpes":["cpe:2.3:a:\\@opentelemetry\\/instrumentation-tedious:\\@opentelemetry\\/instrumentation-tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation-tedious:\\@opentelemetry\\/instrumentation_tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_tedious:\\@opentelemetry\\/instrumentation-tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation_tedious:\\@opentelemetry\\/instrumentation_tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation-tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/instrumentation:\\@opentelemetry\\/instrumentation_tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation-tedious:0.18.1:*:*:*:*:*:*:*","cpe:2.3:a:open-telemetry:\\@opentelemetry\\/instrumentation_tedious:0.18.1:*:*:*:*:*:*:*"],"name":"@opentelemetry/instrumentation-tedious","purl":"pkg:npm/%40opentelemetry/instrumentation-tedious@0.18.1","type":"npm","version":"0.18.1","language":"javascript","licenses":["Apache-2.0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-tedious@0.18.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-tedious/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@opentelemetry+instrumentation-tedious@0.18.1_@opentelemetry+api@1.9.0/node_modules/@opentelemetry/instrumentation-tedious/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.40.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqmp-wf37-98f9","versionConstraint":"<0.40.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@opentelemetry/instrumentation-tedious","version":"0.18.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqmp-wf37-98f9","fix":{"state":"fixed","versions":["0.40.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"0.40.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"risk":0.13176,"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","https://nvd.nist.gov/vuln/detail/CVE-2026-104872","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqmp-wf37-98f9","description":"Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-104872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104872","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104872","date":"2026-10-25","epss":0.00244,"percentile":0.15505}],"urls":["https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"risk":0.131,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"risk":0.13,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"risk":0.1295,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=3.1.3,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110180","cwe":"CWE-436","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110180","date":"2026-10-25","epss":0.00255,"percentile":0.16905}],"risk":0.12494999999999999,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization"},"relatedVulnerabilities":[{"id":"CVE-2026-110180","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110180","cwe":"CWE-436","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110180","date":"2026-10-25","epss":0.00255,"percentile":0.16905}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"risk":0.1205,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f5deb992baf9d929","cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"name":"postcss","purl":"pkg:npm/postcss@8.5.6","type":"npm","version":"8.5.6","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/postcss@8.5.6/node_modules/postcss/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss","version":"8.5.6"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","fix":{"state":"fixed","versions":["8.5.10"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"8.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41305","date":"2026-10-25","epss":0.00205,"percentile":0.1035}],"risk":0.11377499999999999,"urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output"},"relatedVulnerabilities":[{"id":"CVE-2026-41305","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41305","date":"2026-10-25","epss":0.00205,"percentile":0.1035}],"urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue."}]},{"artifact":{"id":"afbf437379fbbc06","cpes":["cpe:2.3:a:hono:hono:4.13.5:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.13.5","type":"npm","version":"4.13.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.13.5/node_modules/hono/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.13.5/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.13.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","fix":{"state":"fixed","versions":["4.13.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"4.13.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-25","epss":0.00227,"percentile":0.13366}],"risk":0.11009499999999998,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS"},"relatedVulnerabilities":[{"id":"CVE-2026-93981","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-25","epss":0.00227,"percentile":0.13366}],"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"risk":0.1035,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-333x-w4r6-6crp","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110725","cwe":"CWE-116","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110725","date":"2026-10-25","epss":0.00302,"percentile":0.22736}],"risk":0.10117,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references"},"relatedVulnerabilities":[{"id":"CVE-2026-110725","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110725","cwe":"CWE-116","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110725","date":"2026-10-25","epss":0.00302,"percentile":0.22736}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"risk":0.1005,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"risk":0.0985,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"risk":0.09749999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110095","date":"2026-10-25","epss":0.00289,"percentile":0.21302}],"risk":0.096815,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","description":"fast-uri vulnerable to improper path equivalence in relative reference normalization"},"relatedVulnerabilities":[{"id":"CVE-2026-110095","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110095","date":"2026-10-25","epss":0.00289,"percentile":0.21302}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand."}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vpgc-2f6g-7w7x","versionConstraint":"<2.8.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vpgc-2f6g-7w7x","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-03-26","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33720","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33720","date":"2026-10-25","epss":0.00183,"percentile":0.07822}],"risk":0.09607500000000001,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-vpgc-2f6g-7w7x","https://nvd.nist.gov/vuln/detail/CVE-2026-33720"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vpgc-2f6g-7w7x","description":"n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK"},"relatedVulnerabilities":[{"id":"CVE-2026-33720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33720","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33720","date":"2026-10-25","epss":0.00183,"percentile":0.07822}],"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-vpgc-2f6g-7w7x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33720","description":"n8n is an open source workflow automation platform. Prior to version 2.8.0, when the `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` environment variable is set to `true`, the OAuth callback handler skips ownership verification of the OAuth state parameter. This allows an attacker to trick a victim into completing an OAuth flow against a credential object the attacker controls, causing the victim's OAuth tokens to be stored in the attacker's credential. The attacker can then use those tokens to execute workflows in their name. This issue only affects instances where `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true` is explicitly configured (non-default). The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Avoid enabling `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true` unless strictly required, and/ or restrict access to the n8n instance to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"risk":0.091,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"risk":0.0895,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"risk":0.086,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-25","epss":0.00186,"percentile":0.08133}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"143074c0601b8300","cpes":["cpe:2.3:a:\\@langchain\\/redis:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/redis","purl":"pkg:npm/%40langchain/redis@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.1.8_@opentelemetry+api@1.9.0_@opentelemetry+sd_68964394359dbbd57bec8b111d69e35f/node_modules/@langchain/redis/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.1.8_@opentelemetry+api@1.9.0_@opentelemetry+sd_68964394359dbbd57bec8b111d69e35f/node_modules/@langchain/redis/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x6v-p487-7qh2","versionConstraint":"<=1.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/redis","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5x6v-p487-7qh2","fix":{"state":"fixed","versions":["1.1.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-25","epss":0.00278,"percentile":0.20073}],"risk":0.07367,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2","https://nvd.nist.gov/vuln/detail/CVE-2026-105799","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x6v-p487-7qh2","description":"LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values"},"relatedVulnerabilities":[{"id":"CVE-2026-105799","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-25","epss":0.00278,"percentile":0.20073}],"urls":["https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105799","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-25","epss":0.00131,"percentile":0.02685}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"5c155d0c8e5f4964","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8ce31585c75b432d24bac4c4a565650367b7e0e26684738e46480b7d084a3a0f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"risk":0.063,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"2ae9d0bcbb7b5e6a","cpes":["cpe:2.3:a:golang:go:1.25.7:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.25.7","type":"go-module","version":"go1.25.7","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4602","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.25.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4602","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27139","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27139","date":"2026-10-25","epss":0.00209,"percentile":0.10972}],"risk":0.057475,"urls":["https://go.dev/issue/77827","https://go.dev/cl/749480"],"severity":"Low","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","description":"On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.\n\nThe impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root."},"relatedVulnerabilities":[{"id":"CVE-2026-27139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27139","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27139","date":"2026-10-25","epss":0.00209,"percentile":0.10972}],"urls":["https://go.dev/cl/749480","https://go.dev/issue/77827","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4602"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27139","description":"On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root."}]},{"artifact":{"id":"cfc5891fd0a0ac23","cpes":["cpe:2.3:a:golang:x\\/sys:v0.18.0:*:*:*:*:*:*:*"],"name":"golang.org/x/sys","purl":"pkg:golang/golang.org/x/sys@v0.18.0","type":"go-module","version":"v0.18.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=","mainModule":"task-runner-launcher","architecture":"amd64","goCompiledVersion":"go1.25.7"},"locations":[{"path":"/usr/local/bin/task-runner-launcher","layerID":"sha256:3a7b55559aca3819624b408295531eb0049f771486b3cdf82009a5e767cb29e8","accessPath":"/usr/local/bin/task-runner-launcher","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.44.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5024","versionConstraint":"<0.44.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/sys","version":"v0.18.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5024","fix":{"state":"fixed","versions":["0.44.0"],"available":[{"date":"2026-04-23","kind":"release","version":"0.44.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39824","date":"2026-10-25","epss":0.00114,"percentile":0.01465}],"risk":0.03591,"urls":["https://go.dev/cl/770080","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"],"severity":"Low","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78916","description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."},"relatedVulnerabilities":[{"id":"CVE-2026-39824","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39824","date":"2026-10-25","epss":0.00114,"percentile":0.01465}],"urls":["https://go.dev/cl/770080","https://go.dev/issue/78916","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg","https://pkg.go.dev/vuln/GO-2026-5024"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39824","description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}]},{"artifact":{"id":"d52f342d0f0f1d8c","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=1.3.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46jr-4wx8-v453","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"},"relatedVulnerabilities":[{"id":"CVE-2026-111768","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-64xh-79j6-r5v8","versionConstraint":"<2.31.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-64xh-79j6-r5v8","fix":{"state":"fixed","versions":["2.31.5"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.31.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-64xh-79j6-r5v8","https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f","https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5","https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-64xh-79j6-r5v8","description":"n8n: Bypass \"Allowed HTTP Request Domains\" Credential Restriction in Multiple AI and LLM Nodes"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8342-988q-86cr","versionConstraint":"<2.31.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8342-988q-86cr","fix":{"state":"fixed","versions":["2.31.5"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.31.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr","https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f","https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5","https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8342-988q-86cr","description":"n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gv7g-jm28-cr3m","versionConstraint":"<2.31.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-gv7g-jm28-cr3m","fix":{"state":"fixed","versions":["2.31.5"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.31.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m","https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f","https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5","https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gv7g-jm28-cr3m","description":"n8n: Expression sandbox escape via arrow-function bodies enabling command execution"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2x7j-588g-ccc2","versionConstraint":"<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2x7j-588g-ccc2","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150","https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e","https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2x7j-588g-ccc2","description":"Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v53p-9fqp-m79j","versionConstraint":"<=10.0.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v53p-9fqp-m79j","fix":{"state":"fixed","versions":["10.0.6"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.0.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v53p-9fqp-m79j","description":"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service"},"relatedVulnerabilities":[]},{"artifact":{"id":"d52f342d0f0f1d8c","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6prh-2h8m-c8cw","versionConstraint":"<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6prh-2h8m-c8cw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","description":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-111769","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"d52f342d0f0f1d8c","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_zod@3.25.67/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=1.6.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service"},"relatedVulnerabilities":[{"id":"CVE-2026-111771","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.19.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vx9-7wpg-88jq","versionConstraint":"<2.19.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vx9-7wpg-88jq","fix":{"state":"fixed","versions":["2.19.3"],"available":[{"date":"2026-05-19","kind":"first-observed","version":"2.19.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-2vx9-7wpg-88jq"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vx9-7wpg-88jq","description":"n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.6.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-364x-8g5j-x2pr","versionConstraint":"<2.6.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-364x-8g5j-x2pr","fix":{"state":"fixed","versions":["2.6.4"],"available":[{"date":"2026-03-28","kind":"first-observed","version":"2.6.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-364x-8g5j-x2pr","description":"n8n has XSS in its Credential Management Flow"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fvfv-ppw4-7h2w","versionConstraint":"<2.10.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-fvfv-ppw4-7h2w","fix":{"state":"fixed","versions":["2.10.0"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.10.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w","https://github.com/n8n-io/n8n/commit/8d0251d1deef256fd3d9176f05dedab62afde918","https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fvfv-ppw4-7h2w","description":"n8n has a Guardrail Node Bypass"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3jj-5f3v-3685","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3jj-5f3v-3685","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3jj-5f3v-3685","description":"n8n: Public API Execution Retry Authorization Bypass"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.25.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jwm3-qcfw-c5pp","versionConstraint":"<2.25.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jwm3-qcfw-c5pp","fix":{"state":"fixed","versions":["2.25.7"],"available":[{"date":"2026-06-17","kind":"first-observed","version":"2.25.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-jwm3-qcfw-c5pp"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jwm3-qcfw-c5pp","description":"n8n: Python Code Node AST Validator Bypass"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pf2q-pxhf-hgmw","versionConstraint":"<2.31.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-pf2q-pxhf-hgmw","fix":{"state":"fixed","versions":["2.31.5"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.31.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":4.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-pf2q-pxhf-hgmw","https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5","https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pf2q-pxhf-hgmw","description":"n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vhf8-cg2h-cg3p","versionConstraint":"<2.31.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vhf8-cg2h-cg3p","fix":{"state":"fixed","versions":["2.31.5"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"2.31.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L","metrics":{"baseScore":6.4},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-vhf8-cg2h-cg3p","https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f","https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5","https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vhf8-cg2h-cg3p","description":"n8n: SSRF Protection Bypass via MCP Client Node"},"relatedVulnerabilities":[]},{"artifact":{"id":"1727dca50452872d","cpes":["cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:community:node.js:*:*","cpe:2.3:a:n8n:n8n:1.123.87:*:*:*:enterprise:node.js:*:*"],"name":"n8n","purl":"pkg:npm/n8n@1.123.87","type":"npm","version":"1.123.87","language":"javascript","licenses":[],"locations":[{"path":"/usr/local/lib/node_modules/n8n/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vjf3-2gpj-233v","versionConstraint":"<2.8.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"n8n","version":"1.123.87"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vjf3-2gpj-233v","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":4,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v","https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976","https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vjf3-2gpj-233v","description":"n8n has an SSO Enforcement Bypass in its Self-Service Settings API"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-268h-hp4c-crq3","versionConstraint":"<=8.0.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-268h-hp4c-crq3","fix":{"state":"fixed","versions":["8.0.9"],"available":[{"date":"2026-06-15","kind":"first-observed","version":"8.0.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-268h-hp4c-crq3","description":"Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6vj9-mwq6-2f5v","versionConstraint":">=5.0.0,<10.0.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6vj9-mwq6-2f5v","fix":{"state":"fixed","versions":["10.0.2"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6vj9-mwq6-2f5v","description":"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-85x2-q946-cp5h","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-85x2-q946-cp5h","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-85x2-q946-cp5h","description":"Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c8m-p3m8-cjg8","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8c8m-p3m8-cjg8","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","description":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8m3c-c648-2xjj","versionConstraint":"<=9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8m3c-c648-2xjj","fix":{"state":"fixed","versions":["9.1.1"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj","https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b","https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8m3c-c648-2xjj","description":"Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8vvx-rff5-p5rq","versionConstraint":"<10.0.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8vvx-rff5-p5rq","fix":{"state":"fixed","versions":["10.0.2"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8vvx-rff5-p5rq","description":"Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cc9r-2j5m-2m83","versionConstraint":">=6.9.16,<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cc9r-2j5m-2m83","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cc9r-2j5m-2m83","description":"Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m943-m63m-w62w","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m943-m63m-w62w","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m943-m63m-w62w","description":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvjj-xcjg-gr5g","versionConstraint":"<=8.0.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vvjj-xcjg-gr5g","fix":{"state":"fixed","versions":["8.0.5"],"available":[{"date":"2026-04-08","kind":"first-observed","version":"8.0.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g","https://github.com/nodemailer/nodemailer/commit/0a43876801a420ca528f492eaa01bfc421cc306e","https://github.com/nodemailer/nodemailer/releases/tag/v8.0.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvjj-xcjg-gr5g","description":"Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmmp-3585-3rmp","versionConstraint":"<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-wmmp-3585-3rmp","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148","https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmmp-3585-3rmp","description":"Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wqvq-jvpq-h66f","versionConstraint":"<=8.0.8 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-wqvq-jvpq-h66f","fix":{"state":"fixed","versions":["8.0.9"],"available":[{"date":"2026-06-15","kind":"first-observed","version":"8.0.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wqvq-jvpq-h66f","description":"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization"},"relatedVulnerabilities":[]},{"artifact":{"id":"030107199260b03d","cpes":["cpe:2.3:a:nodemailer:nodemailer:7.0.11:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@7.0.11","type":"npm","version":"7.0.11","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","layerID":"sha256:3b39476506367cb6309ab1d155dceedb5d78a7c73ba4434b9ada43013811e209","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@7.0.11/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c7w3-x93f-qmm8","versionConstraint":"<8.0.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"7.0.11"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-c7w3-x93f-qmm8","fix":{"state":"fixed","versions":["8.0.4"],"available":[{"date":"2026-03-27","kind":"first-observed","version":"8.0.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://github.com/nodemailer/nodemailer/commit/2d7b9710e63555a1eb13d721296c51186d4b5651"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c7w3-x93f-qmm8","description":"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-26T10:06:50.752Z","grype_db_version":"2026-10-26T06:38:44.000Z"}