{"grype_matches":[{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-0770","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-0770","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-0770","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-0770","date":"2026-10-18","epss":0.05403,"percentile":0.92591}],"risk":4.538520000000001,"urls":["http://secunia.com/advisories/24167","http://secunia.com/advisories/24196","http://www.debian.org/security/2007/dsa-1260","http://www.mandriva.com/security/advisories?name=MDKSA-2007:041","http://www.novell.com/linux/security/advisories/2007_3_sr.html","http://www.osvdb.org/31911","http://www.securityfocus.com/archive/1/459507/100/0/threaded","http://www.ubuntu.com/usn/usn-422-1","https://issues.rpath.com/browse/RPL-1034"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-0770","description":"Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456."},"relatedVulnerabilities":[]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106446","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106446","date":"2026-10-18","epss":0.0064,"percentile":0.4965}],"risk":0.6016,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)"},"relatedVulnerabilities":[{"id":"CVE-2026-106446","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106446","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106446","date":"2026-10-18","epss":0.0064,"percentile":0.4965}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"e62318d2e7910b78","cpes":["cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*"],"name":"braces","purl":"pkg:npm/braces@3.0.3","type":"npm","version":"3.0.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/braces@3.0.3/node_modules/braces/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/braces@3.0.3/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfj7-8cjw-p6xm","versionConstraint":"<=3.0.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"braces","version":"3.0.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vfj7-8cjw-p6xm","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93687","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93687","date":"2026-10-18","epss":0.00757,"percentile":0.54311}],"risk":0.59046,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93687","https://github.com/micromatch/braces/issues/70","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfj7-8cjw-p6xm","description":"braces vulnerable to stack-exhaustion denial of service through deeply nested patterns"},"relatedVulnerabilities":[{"id":"CVE-2026-93687","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93687","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93687","date":"2026-10-18","epss":0.00757,"percentile":0.54311}],"urls":["https://github.com/micromatch/braces","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://github.com/micromatch/braces/issues/70","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns","https://github.com/micromatch/braces/issues/73#issuecomment-5996574974"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93687","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v5mp-jgw5-2x6j","versionConstraint":"<4.1.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v5mp-jgw5-2x6j","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63376","date":"2026-10-18","epss":0.00683,"percentile":0.51603}],"risk":0.5361549999999999,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j","https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v5mp-jgw5-2x6j","description":"toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-63376","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63376","date":"2026-10-18","epss":0.00683,"percentile":0.51603}],"urls":["https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63376","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"1d01ad883d38833b","cpes":["cpe:2.3:a:BinaryMuse:toml:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:3.0.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@3.0.0","type":"npm","version":"3.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@3.0.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-82x6-q7mm-w9cf","versionConstraint":"<4.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"3.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-82x6-q7mm-w9cf","fix":{"state":"fixed","versions":["4.2.0"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"4.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77465","date":"2026-10-18","epss":0.00609,"percentile":0.48101}],"risk":0.45675000000000004,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-82x6-q7mm-w9cf","description":"toml-node: Uncontrolled Recursion"},"relatedVulnerabilities":[{"id":"CVE-2026-77465","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77465","date":"2026-10-18","epss":0.00609,"percentile":0.48101}],"urls":["https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77465","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."}]},{"artifact":{"id":"c87764051de550d7","cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:4.2.0:*:*:*:*:node.js:*:*"],"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["BSD-2-Clause"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ch52-4w7c-c8xp","versionConstraint":"<=4.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"http-cache-semantics","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-ch52-4w7c-c8xp","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-18","epss":0.00569,"percentile":0.45968}],"risk":0.44382,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ch52-4w7c-c8xp","description":"http-cache-semantics max-stale handling can disclose cross-user cached responses"},"relatedVulnerabilities":[{"id":"CVE-2026-93748","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-18","epss":0.00569,"percentile":0.45968}],"urls":["https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://github.com/kornelski/http-cache-semantics/issues/56","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale","https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748","description":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons."}]},{"artifact":{"id":"83d3e58bdcd90e29","cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:4.2.0:*:*:*:*:node.js:*:*"],"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["BSD-2-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ch52-4w7c-c8xp","versionConstraint":"<=4.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"http-cache-semantics","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-ch52-4w7c-c8xp","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-18","epss":0.00569,"percentile":0.45968}],"risk":0.44382,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ch52-4w7c-c8xp","description":"http-cache-semantics max-stale handling can disclose cross-user cached responses"},"relatedVulnerabilities":[{"id":"CVE-2026-93748","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-18","epss":0.00569,"percentile":0.45968}],"urls":["https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://github.com/kornelski/http-cache-semantics/issues/56","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale","https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748","description":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons."}]},{"artifact":{"id":"a98af2947586979d","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-18","epss":0.00549,"percentile":0.44756}],"risk":0.43371,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-18","epss":0.00549,"percentile":0.44756}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"34a0a5e3ece0fdd0","cpes":["cpe:2.3:a:libtiff:libtiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libtiff:tiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:tiff:libtiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:tiff:tiff:4.7.1-r0:*:*:*:*:*:*:*"],"name":"tiff","purl":"pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"4.7.1-r0","language":"","licenses":["libtiff"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libtiff.so.6"},{"path":"/usr/lib/libtiff.so.6.2.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tiff"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.7.2-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"< 4.7.2-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"tiff","version":"4.7.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"4.7.2-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"< 4.7.2-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"tiff","version":"4.7.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"fixed","versions":["4.7.2-r0"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.2-r0"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-18","epss":0.00553,"percentile":0.45031}],"risk":0.423045,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-18","epss":0.00553,"percentile":0.45031}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmmh-p597-ppvv","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rmmh-p597-ppvv","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-18","epss":0.00806,"percentile":0.56002}],"risk":0.41509,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-1899","https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmmh-p597-ppvv","description":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-1899","cvss":[{"type":"Secondary","source":"vulnreport@tenable.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-18","epss":0.00806,"percentile":0.56002}],"urls":["https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1899","description":"An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38c4-r59v-3vqw","versionConstraint":">=13.0.0,<14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-38c4-r59v-3vqw","fix":{"state":"fixed","versions":["14.1.1"],"available":[{"date":"2026-03-04","kind":"first-observed","version":"14.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-18","epss":0.00739,"percentile":0.53678}],"risk":0.38428,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2327","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","description":"markdown-it is has a Regular Expression Denial of Service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-2327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-18","epss":0.00739,"percentile":0.53678}],"urls":["https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition."}]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106445","date":"2026-10-18","epss":0.00411,"percentile":0.33871}],"risk":0.37400999999999995,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","description":"Handlebars: JavaScript Injection via Own Property Check Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-106445","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106445","date":"2026-10-18","epss":0.00411,"percentile":0.33871}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"759d8a1cdfa5f282","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g4wm-2vf7-vfgr","versionConstraint":"<=3.36.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g4wm-2vf7-vfgr","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102826","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102826","date":"2026-10-18","epss":0.00464,"percentile":0.38759}],"risk":0.36192,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr","https://nvd.nist.gov/vuln/detail/CVE-2026-102826","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g4wm-2vf7-vfgr","description":"simple-git allows command execution through unblocked Git configuration includes"},"relatedVulnerabilities":[{"id":"CVE-2026-102826","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102826","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102826","date":"2026-10-18","epss":0.00464,"percentile":0.38759}],"urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102826","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0."}]},{"artifact":{"id":"759d8a1cdfa5f282","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x6jw-m9v5-85vh","versionConstraint":">=3.15.0,<4.0.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x6jw-m9v5-85vh","fix":{"state":"fixed","versions":["4.0.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102828","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102828","date":"2026-10-18","epss":0.00375,"percentile":0.2987}],"risk":0.34125,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","https://nvd.nist.gov/vuln/detail/CVE-2026-102828","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x6jw-m9v5-85vh","description":"simple-git unsafe-operation guard does not block trailer command configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-102828","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102828","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102828","date":"2026-10-18","epss":0.00375,"percentile":0.2987}],"urls":["https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1","https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1."}]},{"artifact":{"id":"759d8a1cdfa5f282","cpes":["cpe:2.3:a:simple-git_project:simple-git:3.36.0:*:*:*:*:node.js:*:*"],"name":"simple-git","purl":"pkg:npm/simple-git@3.36.0","type":"npm","version":"3.36.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/simple-git@3.36.0_supports-color@8.1.1/node_modules/simple-git/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-858h-whjf-mvg5","versionConstraint":"<=3.36.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"simple-git","version":"3.36.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-858h-whjf-mvg5","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102827","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102827","date":"2026-10-18","epss":0.00395,"percentile":0.32121}],"risk":0.30810000000000004,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5","https://nvd.nist.gov/vuln/detail/CVE-2026-102827","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-858h-whjf-mvg5","description":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)"},"relatedVulnerabilities":[{"id":"CVE-2026-102827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102827","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102827","date":"2026-10-18","epss":0.00395,"percentile":0.32121}],"urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102827","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0."}]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rfgv-xxqx-mfg5","versionConstraint":">=6.7.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rfgv-xxqx-mfg5","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-18","epss":0.00394,"percentile":0.32014}],"risk":0.29550000000000004,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534","https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5","description":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol"},"relatedVulnerabilities":[{"id":"CVE-2026-19534","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-18","epss":0.00394,"percentile":0.32014}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"275ecdfab3727287","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rfgv-xxqx-mfg5","versionConstraint":">=6.7.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rfgv-xxqx-mfg5","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-18","epss":0.00394,"percentile":0.32014}],"risk":0.29550000000000004,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534","https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5","description":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol"},"relatedVulnerabilities":[{"id":"CVE-2026-19534","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-18","epss":0.00394,"percentile":0.32014}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"5a0f4c103779f950","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1.3.2-r1"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.3.2-r1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-18","epss":0.00356,"percentile":0.27712}],"risk":0.28124,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-18","epss":0.00356,"percentile":0.27712}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-32460","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-32460","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32460","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32460","date":"2026-10-18","epss":0.00359,"percentile":0.28166}],"risk":0.2791225,"urls":["https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb","https://issues.oss-fuzz.com/issues/406320404","https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pph-fpjx-jg34","versionConstraint":">=2.2.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3pph-fpjx-jg34","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-18","epss":0.00532,"percentile":0.437}],"risk":0.27398,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34","https://nvd.nist.gov/vuln/detail/CVE-2026-88932","https://github.com/expressjs/multer/commit/53337f9713619ef3381ee6b4e541f926dbaac305","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.4.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","description":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads"},"relatedVulnerabilities":[{"id":"CVE-2026-88932","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-18","epss":0.00532,"percentile":0.437}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","description":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g6gw-c38x-mqfc","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g6gw-c38x-mqfc","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-18","epss":0.00529,"percentile":0.43511}],"risk":0.27243500000000004,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc","https://nvd.nist.gov/vuln/detail/CVE-2026-84364","https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g6gw-c38x-mqfc","description":"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-84364","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-18","epss":0.00529,"percentile":0.43511}],"urls":["https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84364","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-18","epss":0.0054,"percentile":0.44227}],"risk":0.27,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","description":"qs array-limit bypass via bracket-key comma parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-82562","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-18","epss":0.0054,"percentile":0.44227}],"urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input."}]},{"artifact":{"id":"ac0d9b4863f91c97","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","fix":{"state":"fixed","versions":["5.0.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-18","epss":0.0035,"percentile":0.27108}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102278","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-18","epss":0.0035,"percentile":0.27108}],"urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","fix":{"state":"fixed","versions":["5.0.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-18","epss":0.0035,"percentile":0.27108}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102278","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-18","epss":0.0035,"percentile":0.27108}],"urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","fix":{"state":"fixed","versions":["5.0.10"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-18","epss":0.0035,"percentile":0.27106}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-18","epss":0.0035,"percentile":0.27106}],"urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10."}]},{"artifact":{"id":"ac0d9b4863f91c97","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","fix":{"state":"fixed","versions":["5.0.10"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-18","epss":0.0035,"percentile":0.27106}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-18","epss":0.0035,"percentile":0.27106}],"urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10."}]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6gq-j5cr-w38f","versionConstraint":"<=9.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-p6gq-j5cr-w38f","fix":{"state":"fixed","versions":["9.0.1"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"9.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82659","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82659","date":"2026-10-18","epss":0.00349,"percentile":0.26894}],"risk":0.25477,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-68x8-4h5v-r533","https://nvd.nist.gov/vuln/detail/CVE-2026-82659","https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2","https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6gq-j5cr-w38f","description":"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message"},"relatedVulnerabilities":[{"id":"CVE-2026-82659","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82659","cwe":"CWE-73","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82659","date":"2026-10-18","epss":0.00349,"percentile":0.26894}],"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82659","description":"nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients."}]},{"artifact":{"id":"9efa366ab366f908","cpes":["cpe:2.3:a:\\@langchain\\/mongodb:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/mongodb","purl":"pkg:npm/%40langchain/mongodb@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6rx-h84q-8r95","versionConstraint":"<=1.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/mongodb","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m6rx-h84q-8r95","fix":{"state":"fixed","versions":["1.3.1"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"1.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-18","epss":0.00463,"percentile":0.38694}],"risk":0.25465000000000004,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","https://nvd.nist.gov/vuln/detail/CVE-2026-106119","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","description":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"},"relatedVulnerabilities":[{"id":"CVE-2026-106119","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-18","epss":0.00463,"percentile":0.38694}],"urls":["https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gqvv-2mrq-wpjv","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-gqvv-2mrq-wpjv","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-18","epss":0.00437,"percentile":0.36563}],"risk":0.25127499999999997,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","description":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory"},"relatedVulnerabilities":[{"id":"CVE-2026-84365","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-18","epss":0.00437,"percentile":0.36563}],"urls":["https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84365","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"90b2fe63ad4df1bf","cpes":["cpe:2.3:a:\\@simple-git\\/argv-parser:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv-parser:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv_parser:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv_parser:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple-git\\/argv:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple_git\\/argv:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple:\\@simple-git\\/argv-parser:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@simple:\\@simple_git\\/argv_parser:1.1.1:*:*:*:*:*:*:*"],"name":"@simple-git/argv-parser","purl":"pkg:npm/%40simple-git/argv-parser@1.1.1","type":"npm","version":"1.1.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@simple-git+argv-parser@1.1.1/node_modules/@simple-git/argv-parser/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@simple-git+argv-parser@1.1.1/node_modules/@simple-git/argv-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v5rq-49vh-5v5c","versionConstraint":"<2.0.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@simple-git/argv-parser","version":"1.1.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v5rq-49vh-5v5c","fix":{"state":"fixed","versions":["2.0.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"2.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102829","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102829","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102829","date":"2026-10-18","epss":0.00275,"percentile":0.18573}],"risk":0.25025,"urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c","https://nvd.nist.gov/vuln/detail/CVE-2026-102829","https://github.com/steveukx/git-js/pull/1201","https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4","https://github.com/steveukx/git-js/releases/tag/@simple-git/argv-parser@2.0.1"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v5rq-49vh-5v5c","description":"simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection"},"relatedVulnerabilities":[{"id":"CVE-2026-102829","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102829","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102829","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102829","date":"2026-10-18","epss":0.00275,"percentile":0.18573}],"urls":["https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4","https://github.com/steveukx/git-js/pull/1201","https://github.com/steveukx/git-js/releases/tag/@simple-git/argv-parser@2.0.1","https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102829","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crvj-82cr-hjcx","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-crvj-82cr-hjcx","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-18","epss":0.00448,"percentile":0.37521}],"risk":0.24416,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx","https://nvd.nist.gov/vuln/detail/CVE-2026-84363","https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crvj-82cr-hjcx","description":"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials"},"relatedVulnerabilities":[{"id":"CVE-2026-84363","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-18","epss":0.00448,"percentile":0.37521}],"urls":["https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84363","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"178f8b3f0c14d5d7","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.5.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.5.0","type":"npm","version":"10.5.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.5.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-18","epss":0.00386,"percentile":0.31088}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-18","epss":0.00418,"percentile":0.34628}],"risk":0.22572,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","description":"qs: Denial of Service via Attacker Controlled isBuffer"},"relatedVulnerabilities":[{"id":"CVE-2026-82417","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-18","epss":0.00418,"percentile":0.34628}],"urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs."}]},{"artifact":{"id":"275ecdfab3727287","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wwx-pv8p-q78v","versionConstraint":">=6.25.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3wwx-pv8p-q78v","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-18","epss":0.00412,"percentile":0.33969}],"risk":0.22454000000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wwx-pv8p-q78v","description":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"},"relatedVulnerabilities":[{"id":"CVE-2026-85024","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-18","epss":0.00412,"percentile":0.33969}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","description":"undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wwx-pv8p-q78v","versionConstraint":">=6.25.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3wwx-pv8p-q78v","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-18","epss":0.00412,"percentile":0.33969}],"risk":0.22454000000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wwx-pv8p-q78v","description":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"},"relatedVulnerabilities":[{"id":"CVE-2026-85024","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-18","epss":0.00412,"percentile":0.33969}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","description":"undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","fix":{"state":"fixed","versions":["14.2.0"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"14.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-18","epss":0.00432,"percentile":0.35964}],"risk":0.22248000000000004,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations"},"relatedVulnerabilities":[{"id":"CVE-2026-48988","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-18","epss":0.00432,"percentile":0.35964}],"urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"178f8b3f0c14d5d7","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.5.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.5.0","type":"npm","version":"10.5.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.5.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-18","epss":0.00386,"percentile":0.31087}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"6d0797d2a380fcd0","cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*"],"name":"postcss-selector-parser","purl":"pkg:npm/postcss-selector-parser@7.1.4","type":"npm","version":"7.1.4","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<7.1.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss-selector-parser","version":"7.1.4"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","fix":{"state":"fixed","versions":["7.1.6"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"7.1.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-18","epss":0.00394,"percentile":0.31981}],"risk":0.21473,"urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-104844","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-18","epss":0.00394,"percentile":0.31981}],"urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6."}]},{"artifact":{"id":"ee116feb549418a4","cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*"],"name":"postcss-selector-parser","purl":"pkg:npm/postcss-selector-parser@7.1.4","type":"npm","version":"7.1.4","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<7.1.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss-selector-parser","version":"7.1.4"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","fix":{"state":"fixed","versions":["7.1.6"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"7.1.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-18","epss":0.00394,"percentile":0.31981}],"risk":0.21473,"urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-104844","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-18","epss":0.00394,"percentile":0.31981}],"urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"178f8b3f0c14d5d7","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.5.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.5.0","type":"npm","version":"10.5.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.5.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-18","epss":0.0037,"percentile":0.29367}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-18","epss":0.00428,"percentile":0.35614}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ab5593bbdf9ba16a","cpes":["cpe:2.3:a:momentjs:moment:2.30.1:*:*:*:*:node.js:*:*"],"name":"moment","purl":"pkg:npm/moment@2.30.1","type":"npm","version":"2.30.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"moment","version":"2.30.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-18","epss":0.00357,"percentile":0.27831}],"risk":0.194565,"urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","description":"moment vulnerable to Path Traversal via crafted non-string locale name"},"relatedVulnerabilities":[{"id":"CVE-2026-17495","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-18","epss":0.00357,"percentile":0.27831}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale()."}]},{"artifact":{"id":"a98af2947586979d","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-18","epss":0.00348,"percentile":0.26866}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-18","epss":0.00348,"percentile":0.26866}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22g5-r2x5-97cx","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22g5-r2x5-97cx","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-18","epss":0.00338,"percentile":0.25657}],"risk":0.18083,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59710","https://github.com/showdownjs/showdown/issues/1046","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22g5-r2x5-97cx","description":"showdown allows stored cross-site scripting through table header ID injection"},"relatedVulnerabilities":[{"id":"CVE-2026-59710","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-18","epss":0.00338,"percentile":0.25657}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown/issues/1046","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59710","description":"showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cr32-g25g-vxjj","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cr32-g25g-vxjj","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-18","epss":0.00327,"percentile":0.24213}],"risk":0.17494499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59711","https://github.com/showdownjs/showdown/issues/1047","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument","https://github.com/showdownjs/showdown/commit/184a3e4e97f90e075c4512f2c4c06dcf655e91b7"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cr32-g25g-vxjj","description":"showdown metadata title handling allows cross-site scripting"},"relatedVulnerabilities":[{"id":"CVE-2026-59711","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-18","epss":0.00327,"percentile":0.24213}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/issues/1047","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59711","description":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"178f8b3f0c14d5d7","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.5.0:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.5.0","type":"npm","version":"10.5.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.5.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-18","epss":0.00301,"percentile":0.2138}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"ac0d9b4863f91c97","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","fix":{"state":"fixed","versions":["5.0.12"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-18","epss":0.00301,"percentile":0.21379}],"risk":0.15501500000000001,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-102277","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-18","epss":0.00301,"percentile":0.21379}],"urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","fix":{"state":"fixed","versions":["5.0.12"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-18","epss":0.00301,"percentile":0.21379}],"risk":0.15501500000000001,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-102277","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-18","epss":0.00301,"percentile":0.21379}],"urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12."}]},{"artifact":{"id":"bb3bb0d123bb84ee","cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"name":"handlebars","purl":"pkg:npm/handlebars@4.7.9","type":"npm","version":"4.7.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/handlebars@4.7.9/node_modules/handlebars/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"handlebars","version":"4.7.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","fix":{"state":"fixed","versions":["4.7.10"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106444","date":"2026-10-18","epss":0.00294,"percentile":0.20639}],"risk":0.14259,"urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates"},"relatedVulnerabilities":[{"id":"CVE-2026-106444","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106444","date":"2026-10-18","epss":0.00294,"percentile":0.20639}],"urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10."}]},{"artifact":{"id":"7772b4d6519da701","cpes":["cpe:2.3:a:element-plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element-plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element_plus:2.4.3:*:*:*:*:*:*:*"],"name":"element-plus","purl":"pkg:npm/element-plus@2.4.3","type":"npm","version":"2.4.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5m5x-9j46-h678","versionConstraint":"<=2.11.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"element-plus","version":"2.4.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5m5x-9j46-h678","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-18","epss":0.00236,"percentile":0.13578}],"risk":0.13688,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-57665","https://github.com/element-plus/element-plus/pull/21711","https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://www.npmjs.com/package/element-plus","https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5m5x-9j46-h678","description":"Element Plus Link component (el-link) implements insufficient input validation for the href attribute"},"relatedVulnerabilities":[{"id":"CVE-2025-57665","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-18","epss":0.00236,"percentile":0.13578}],"urls":["https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://github.com/element-plus/element-plus/pull/21711","https://www.npmjs.com/package/element-plus"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57665","description":"Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","fix":{"state":"fixed","versions":["4.13.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"4.13.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-18","epss":0.00227,"percentile":0.1255}],"risk":0.11009499999999998,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS"},"relatedVulnerabilities":[{"id":"CVE-2026-93981","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-18","epss":0.00227,"percentile":0.1255}],"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mjw6-4jj6-33hc","versionConstraint":"<3.6.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mjw6-4jj6-33hc","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-18","epss":0.00195,"percentile":0.08606}],"risk":0.098475,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc","https://nvd.nist.gov/vuln/detail/CVE-2026-104183","https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mjw6-4jj6-33hc","description":"stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects"},"relatedVulnerabilities":[{"id":"CVE-2026-104183","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-18","epss":0.00195,"percentile":0.08606}],"urls":["https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104183","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-528h-pc64-c93x","versionConstraint":"<=3.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-528h-pc64-c93x","fix":{"state":"fixed","versions":["3.5.0"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"3.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-18","epss":0.0016,"percentile":0.04812}],"risk":0.08960000000000001,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-528h-pc64-c93x","description":"stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-71429","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-18","epss":0.0016,"percentile":0.04812}],"urls":["https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6","https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71429","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-18","epss":0.00171,"percentile":0.06025}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-18","epss":0.00186,"percentile":0.07676}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":"<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-18","epss":0.00239,"percentile":0.13951}],"risk":0.080065,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","description":"undici vulnerable to downstream response splitting via retry interceptor"},"relatedVulnerabilities":[{"id":"CVE-2026-18540","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-18","epss":0.00239,"percentile":0.13951}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"275ecdfab3727287","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:8f294ec8bd20e884384d151dbf207f4ee09a14d958f1d7412aead32a67ecd8a0","accessPath":"/usr/local/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":"<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-18","epss":0.00239,"percentile":0.13951}],"risk":0.080065,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","description":"undici vulnerable to downstream response splitting via retry interceptor"},"relatedVulnerabilities":[{"id":"CVE-2026-18540","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-18","epss":0.00239,"percentile":0.13951}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hqr4-qq8f-hg3x","versionConstraint":"<=3.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hqr4-qq8f-hg3x","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-18","epss":0.00138,"percentile":0.02894}],"risk":0.07728,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x","https://nvd.nist.gov/vuln/detail/CVE-2026-104182","https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hqr4-qq8f-hg3x","description":"stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk"},"relatedVulnerabilities":[{"id":"CVE-2026-104182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-18","epss":0.00138,"percentile":0.02894}],"urls":["https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104182","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"ea76f17754cba393","cpes":["cpe:2.3:a:\\@langchain\\/redis:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/redis","purl":"pkg:npm/%40langchain/redis@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x6v-p487-7qh2","versionConstraint":"<=1.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/redis","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5x6v-p487-7qh2","fix":{"state":"fixed","versions":["1.1.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-18","epss":0.00278,"percentile":0.18947}],"risk":0.07367,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2","https://nvd.nist.gov/vuln/detail/CVE-2026-105799","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x6v-p487-7qh2","description":"LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values"},"relatedVulnerabilities":[{"id":"CVE-2026-105799","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-18","epss":0.00278,"percentile":0.18947}],"urls":["https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105799","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1."}]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2x7j-588g-ccc2","versionConstraint":"<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2x7j-588g-ccc2","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150","https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e","https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2x7j-588g-ccc2","description":"Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v53p-9fqp-m79j","versionConstraint":"<=10.0.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-v53p-9fqp-m79j","fix":{"state":"fixed","versions":["10.0.6"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.0.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v53p-9fqp-m79j","description":"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service"},"relatedVulnerabilities":[]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-253c-mchw-3w2r","fix":{"state":"fixed","versions":["14.3.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"14.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6vj9-mwq6-2f5v","versionConstraint":">=5.0.0,<10.0.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6vj9-mwq6-2f5v","fix":{"state":"fixed","versions":["10.0.2"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6vj9-mwq6-2f5v","description":"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8m3c-c648-2xjj","versionConstraint":"<=9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8m3c-c648-2xjj","fix":{"state":"fixed","versions":["9.1.1"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj","https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b","https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8m3c-c648-2xjj","description":"Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8vvx-rff5-p5rq","versionConstraint":"<10.0.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8vvx-rff5-p5rq","fix":{"state":"fixed","versions":["10.0.2"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8vvx-rff5-p5rq","description":"Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cc9r-2j5m-2m83","versionConstraint":">=6.9.16,<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cc9r-2j5m-2m83","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cc9r-2j5m-2m83","description":"Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain"},"relatedVulnerabilities":[]},{"artifact":{"id":"631511184b49ac5d","cpes":["cpe:2.3:a:nodemailer:nodemailer:8.0.10:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@8.0.10","type":"npm","version":"8.0.10","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@8.0.10/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"9.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmmp-3585-3rmp","versionConstraint":"<9.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"8.0.10"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-wmmp-3585-3rmp","fix":{"state":"fixed","versions":["9.1.0"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"9.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148","https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmmp-3585-3rmp","description":"Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain"},"relatedVulnerabilities":[]},{"artifact":{"id":"1c6d2c226c0741b3","cpes":["cpe:2.3:a:sprintf-js:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf-js:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf_js:1.0.3:*:*:*:*:*:*:*"],"name":"sprintf-js","purl":"pkg:npm/sprintf-js@1.0.3","type":"npm","version":"1.0.3","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.0.3/node_modules/sprintf-js/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.0.3/node_modules/sprintf-js/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hp3w-g68c-fv3c","versionConstraint":"<=1.1.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sprintf-js","version":"1.0.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hp3w-g68c-fv3c","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-97058","https://github.com/alexei/sprintf.js/issues/237","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90","https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hp3w-g68c-fv3c","description":"sprintf-js vulnerable to denial of service through unbounded precision specifiers"},"relatedVulnerabilities":[{"id":"CVE-2026-97058","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97058","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]},{"artifact":{"id":"94bdf0044f06b439","cpes":["cpe:2.3:a:sprintf-js:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf-js:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf_js:1.1.3:*:*:*:*:*:*:*"],"name":"sprintf-js","purl":"pkg:npm/sprintf-js@1.1.3","type":"npm","version":"1.1.3","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/package.json","layerID":"sha256:200b641a9ce9684352ed1a964ad2e71342dde3eafcd8c409e8af81c862cc9784","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hp3w-g68c-fv3c","versionConstraint":"<=1.1.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sprintf-js","version":"1.1.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hp3w-g68c-fv3c","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-97058","https://github.com/alexei/sprintf.js/issues/237","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90","https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hp3w-g68c-fv3c","description":"sprintf-js vulnerable to denial of service through unbounded precision specifiers"},"relatedVulnerabilities":[{"id":"CVE-2026-97058","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97058","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}],"grade":"F","score":"0.00","as_of":"2026-10-20T06:04:47.834Z","grype_db_version":"2026-10-19T06:39:15.000Z"}