{"grype_matches":[{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-0770","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-0770","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-0770","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-0770","date":"2026-10-24","epss":0.05403,"percentile":0.9267}],"risk":4.538520000000001,"urls":["http://secunia.com/advisories/24167","http://secunia.com/advisories/24196","http://www.debian.org/security/2007/dsa-1260","http://www.mandriva.com/security/advisories?name=MDKSA-2007:041","http://www.novell.com/linux/security/advisories/2007_3_sr.html","http://www.osvdb.org/31911","http://www.securityfocus.com/archive/1/459507/100/0/threaded","http://www.ubuntu.com/usn/usn-422-1","https://issues.rpath.com/browse/RPL-1034"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-0770","description":"Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456."},"relatedVulnerabilities":[]},{"artifact":{"id":"e6497d47e316508b","cpes":["cpe:2.3:a:brotli-libs:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli-libs:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli_libs:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli_libs:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:brotli:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:google:brotli-libs:1.2.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:google:brotli_libs:1.2.0-r1:*:*:*:*:*:*:*"],"name":"brotli-libs","purl":"pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=alpine-3.24&upstream=brotli","type":"apk","version":"1.2.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libbrotlicommon.so.1"},{"path":"/usr/lib/libbrotlicommon.so.1.2.0"},{"path":"/usr/lib/libbrotlidec.so.1"},{"path":"/usr/lib/libbrotlidec.so.1.2.0"},{"path":"/usr/lib/libbrotlienc.so.1"},{"path":"/usr/lib/libbrotlienc.so.1.2.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"brotli"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 1.2.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"brotli","version":"1.2.0-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["1.2.1-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.2.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-24","epss":0.0071,"percentile":0.53063}],"risk":0.6461,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111497"},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-24","epss":0.0071,"percentile":0.53063}],"urls":["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","fix":{"state":"fixed","versions":["14.3.2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"14.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111759","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111759","date":"2026-10-24","epss":0.00598,"percentile":0.48011}],"risk":0.4485,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes"},"relatedVulnerabilities":[{"id":"CVE-2026-111759","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111759","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111759","date":"2026-10-24","epss":0.00598,"percentile":0.48011}],"urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmmh-p597-ppvv","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rmmh-p597-ppvv","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-24","epss":0.00806,"percentile":0.56421}],"risk":0.41509,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-1899","https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmmh-p597-ppvv","description":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-1899","cvss":[{"type":"Secondary","source":"vulnreport@tenable.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-24","epss":0.00806,"percentile":0.56421}],"urls":["https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1899","description":"An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38c4-r59v-3vqw","versionConstraint":">=13.0.0,<14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-38c4-r59v-3vqw","fix":{"state":"fixed","versions":["14.1.1"],"available":[{"date":"2026-03-04","kind":"first-observed","version":"14.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-24","epss":0.00739,"percentile":0.5411}],"risk":0.38428,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2327","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","description":"markdown-it is has a Regular Expression Denial of Service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-2327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-24","epss":0.00739,"percentile":0.5411}],"urls":["https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition."}]},{"artifact":{"id":"340925abcfb4f680","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-24","epss":0.00436,"percentile":0.36924}],"risk":0.34225999999999995,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-24","epss":0.00436,"percentile":0.36924}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"e2cc73391186523d","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-24","epss":0.00436,"percentile":0.36924}],"risk":0.34225999999999995,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-24","epss":0.00436,"percentile":0.36924}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q7qp-rjg7-q26m","versionConstraint":">=2.0.0,<2.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q7qp-rjg7-q26m","fix":{"state":"fixed","versions":["2.5.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"2.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113872","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-113872","cwe":"CWE-404","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-113872","date":"2026-10-24","epss":0.00441,"percentile":0.37338}],"risk":0.33075,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m","https://nvd.nist.gov/vuln/detail/CVE-2026-113872","https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.5.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","description":"multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown"},"relatedVulnerabilities":[{"id":"CVE-2026-113872","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113872","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-113872","cwe":"CWE-404","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-113872","date":"2026-10-24","epss":0.00441,"percentile":0.37338}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872","description":"multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54240","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54240","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54240","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54240","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54240","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54240","date":"2026-10-24","epss":0.00393,"percentile":0.32329}],"risk":0.292785,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54240"},"relatedVulnerabilities":[{"id":"CVE-2026-54240","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54240","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54240","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54240","date":"2026-10-24","epss":0.00393,"percentile":0.32329}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54240","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54241","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54241","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-54241","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54241","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54241","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54241","date":"2026-10-24","epss":0.00393,"percentile":0.32329}],"risk":0.292785,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-54241"},"relatedVulnerabilities":[{"id":"CVE-2026-54241","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54241","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54241","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54241","date":"2026-10-24","epss":0.00393,"percentile":0.32329}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54241","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch."}]},{"artifact":{"id":"340925abcfb4f680","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-24","epss":0.00365,"percentile":0.29251}],"risk":0.286525,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-24","epss":0.00365,"percentile":0.29251}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"e2cc73391186523d","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-24","epss":0.00365,"percentile":0.29251}],"risk":0.286525,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111756","date":"2026-10-24","epss":0.00365,"percentile":0.29251}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-32460","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-32460","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32460","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32460","date":"2026-10-24","epss":0.00359,"percentile":0.28582}],"risk":0.2791225,"urls":["https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb","https://issues.oss-fuzz.com/issues/406320404","https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call."},"relatedVulnerabilities":[]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22jm-h49p-29qw","versionConstraint":">=1.24.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22jm-h49p-29qw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111767","date":"2026-10-24","epss":0.00345,"percentile":0.26837}],"risk":0.277725,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22jm-h49p-29qw","description":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them"},"relatedVulnerabilities":[{"id":"CVE-2026-111767","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111767","date":"2026-10-24","epss":0.00345,"percentile":0.26837}],"urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0."}]},{"artifact":{"id":"62a2cdf409aecaab","cpes":["cpe:2.3:a:openjsf:body-parser:2.3.0:*:*:*:*:node.js:*:*"],"name":"body-parser","purl":"pkg:npm/body-parser@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/body-parser@2.3.0_supports-color@8.1.1/node_modules/body-parser/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/body-parser@2.3.0_supports-color@8.1.1/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":">=2.0.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"body-parser","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-27r3-jxmh-p828","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-111181","date":"2026-10-24","epss":0.00366,"percentile":0.29365}],"risk":0.2745,"urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body"},"relatedVulnerabilities":[{"id":"CVE-2026-111181","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-111181","date":"2026-10-24","epss":0.00366,"percentile":0.29365}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created."}]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pph-fpjx-jg34","versionConstraint":">=2.2.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3pph-fpjx-jg34","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-24","epss":0.00532,"percentile":0.44171}],"risk":0.27398,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34","https://nvd.nist.gov/vuln/detail/CVE-2026-88932","https://github.com/expressjs/multer/commit/53337f9713619ef3381ee6b4e541f926dbaac305","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.4.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","description":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads"},"relatedVulnerabilities":[{"id":"CVE-2026-88932","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-24","epss":0.00532,"percentile":0.44171}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","description":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g6gw-c38x-mqfc","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g6gw-c38x-mqfc","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-24","epss":0.00529,"percentile":0.43978}],"risk":0.27243500000000004,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc","https://nvd.nist.gov/vuln/detail/CVE-2026-84364","https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g6gw-c38x-mqfc","description":"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-84364","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-24","epss":0.00529,"percentile":0.43978}],"urls":["https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84364","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49346","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49346","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49346","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49346","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49346","date":"2026-10-24","epss":0.00371,"percentile":0.29884}],"risk":0.27082999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49346"},"relatedVulnerabilities":[{"id":"CVE-2026-49346","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49346","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49346","date":"2026-10-24","epss":0.00371,"percentile":0.29884}],"urls":["https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8","https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49346","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in `de265_image_get_buffer()` (`libde265/image.cc:128`). The overflow wraps the plane allocation size to a small value (~1 KB), but the subsequent `fill_image()` call computes the real size using `size_t`, writing ~4 GB into the undersized heap buffer. Version 1.1.0 patches the issue."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-24","epss":0.0054,"percentile":0.447}],"risk":0.27,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","description":"qs array-limit bypass via bracket-key comma parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-82562","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-24","epss":0.0054,"percentile":0.447}],"urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input."}]},{"artifact":{"id":"5ad68a5490421ca6","cpes":["cpe:2.3:a:zod:zod:3.25.76:*:*:*:*:*:*:*"],"name":"zod","purl":"pkg:npm/zod@3.25.76","type":"npm","version":"3.25.76","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/zod@3.25.76/node_modules/zod/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/zod@3.25.76/node_modules/zod/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"zod","version":"3.25.76"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","fix":{"state":"fixed","versions":["4.6.6"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"4.6.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-54404","cwe":"CWE-770","type":"Primary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2023-54404","cwe":"CWE-1188","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-24","epss":0.0035,"percentile":0.27515}],"risk":0.268625,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","description":"Zod can exhaust memory while validating oversized constrained collections"},"relatedVulnerabilities":[{"id":"CVE-2023-54404","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-54404","cwe":"CWE-770","type":"Primary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2023-54404","cwe":"CWE-1188","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2023-54404","date":"2026-10-24","epss":0.0035,"percentile":0.27515}],"urls":["https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://github.com/colinhacks/zod/pull/6652","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","description":"Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged."}]},{"artifact":{"id":"a46dfc164d2185dd","cpes":["cpe:2.3:a:microsoft:azure\\/msal-node:5.1.5:*:*:*:*:node.js:*:*"],"name":"@azure/msal-node","purl":"pkg:npm/%40azure/msal-node@5.1.5","type":"npm","version":"5.1.5","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@azure+msal-node@5.1.5/node_modules/@azure/msal-node/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@azure+msal-node@5.1.5/node_modules/@azure/msal-node/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xcx6-jx8p-x3h5","versionConstraint":">=5.0.0-beta.0,<7.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@azure/msal-node","version":"5.1.5"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xcx6-jx8p-x3h5","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-109461","date":"2026-10-24","epss":0.00348,"percentile":0.27176}],"risk":0.261,"urls":["https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5","https://nvd.nist.gov/vuln/detail/CVE-2026-109461","https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901","https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e","https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","description":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint"},"relatedVulnerabilities":[{"id":"CVE-2026-109461","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-109461","date":"2026-10-24","epss":0.00348,"percentile":0.27176}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109461","description":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network."}]},{"artifact":{"id":"330b150cc9109363","cpes":["cpe:2.3:a:microsoft:azure\\/msal-node:5.6.0:*:*:*:*:node.js:*:*"],"name":"@azure/msal-node","purl":"pkg:npm/%40azure/msal-node@5.6.0","type":"npm","version":"5.6.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@azure+msal-node@5.6.0/node_modules/@azure/msal-node/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@azure+msal-node@5.6.0/node_modules/@azure/msal-node/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xcx6-jx8p-x3h5","versionConstraint":">=5.0.0-beta.0,<7.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@azure/msal-node","version":"5.6.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xcx6-jx8p-x3h5","fix":{"state":"fixed","versions":["7.1.0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-109461","date":"2026-10-24","epss":0.00348,"percentile":0.27176}],"risk":0.261,"urls":["https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5","https://nvd.nist.gov/vuln/detail/CVE-2026-109461","https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901","https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e","https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","description":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint"},"relatedVulnerabilities":[{"id":"CVE-2026-109461","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-109461","date":"2026-10-24","epss":0.00348,"percentile":0.27176}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109461","description":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network."}]},{"artifact":{"id":"ecd3512b2296d0af","cpes":["cpe:2.3:a:nodejs:undici:6.28.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.1","type":"npm","version":"6.28.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:a5268dfebd2a4648e3636d70f10503884965334ab0b68ee4cae2560bbc1caf1e","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=6.23.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"risk":0.25725000000000003,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"5818e0dae407ee67","cpes":["cpe:2.3:a:nodejs:undici:6.29.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.29.0","type":"npm","version":"6.29.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@6.29.0/node_modules/undici/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@6.29.0/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=6.23.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.29.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"risk":0.25725000000000003,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=7.18.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xjj6-f33q-929c","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"risk":0.25725000000000003,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"},"relatedVulnerabilities":[{"id":"CVE-2026-109869","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-109869","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109869","date":"2026-10-24","epss":0.00343,"percentile":0.26698}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45382","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45382","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-45382","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45382","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45382","date":"2026-10-24","epss":0.00428,"percentile":0.36038}],"risk":0.25466,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-45382"},"relatedVulnerabilities":[{"id":"CVE-2026-45382","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45382","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45382","date":"2026-10-24","epss":0.00428,"percentile":0.36038}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45382","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue."}]},{"artifact":{"id":"9efa366ab366f908","cpes":["cpe:2.3:a:\\@langchain\\/mongodb:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/mongodb","purl":"pkg:npm/%40langchain/mongodb@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6rx-h84q-8r95","versionConstraint":"<=1.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/mongodb","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m6rx-h84q-8r95","fix":{"state":"fixed","versions":["1.3.1"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"1.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-24","epss":0.00463,"percentile":0.392}],"risk":0.25465000000000004,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","https://nvd.nist.gov/vuln/detail/CVE-2026-106119","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","description":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"},"relatedVulnerabilities":[{"id":"CVE-2026-106119","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-24","epss":0.00463,"percentile":0.392}],"urls":["https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}]},{"artifact":{"id":"b5ec402032a70d94","cpes":["cpe:2.3:a:BinaryMuse:toml:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:4.2.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9qmh-m7c6-f92p","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-9qmh-m7c6-f92p","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-114144","cwe":"CWE-770","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114144","date":"2026-10-24","epss":0.00339,"percentile":0.26153}],"risk":0.25425,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p","https://nvd.nist.gov/vuln/detail/CVE-2026-114144","https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","description":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114144","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-114144","cwe":"CWE-770","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114144","date":"2026-10-24","epss":0.00339,"percentile":0.26153}],"urls":["https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45383","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45383","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-45383","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45383","date":"2026-10-24","epss":0.00426,"percentile":0.35815}],"risk":0.25347,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-45383"},"relatedVulnerabilities":[{"id":"CVE-2026-45383","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45383","date":"2026-10-24","epss":0.00426,"percentile":0.35815}],"urls":["https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45383","description":"libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gqvv-2mrq-wpjv","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-gqvv-2mrq-wpjv","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-24","epss":0.00437,"percentile":0.3702}],"risk":0.25127499999999997,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","description":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory"},"relatedVulnerabilities":[{"id":"CVE-2026-84365","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-24","epss":0.00437,"percentile":0.3702}],"urls":["https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84365","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49295","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49295","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49295","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49295","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49295","date":"2026-10-24","epss":0.00338,"percentile":0.2606}],"risk":0.24674000000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49295"},"relatedVulnerabilities":[{"id":"CVE-2026-49295","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49295","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49295","date":"2026-10-24","epss":0.00338,"percentile":0.2606}],"urls":["https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b","https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49295","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in `decoder_context::process_reference_picture_set()` (`libde265/decctx.cc:1376`). The root cause is a missing aggregate bound check on predicted short-term reference picture set entries. Individual list sizes are validated, but the combined count after predicted RPS construction can exceed the 16-entry `PocStFoll` array, writing at index 16. Version 1.0.20 patches the issue."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crvj-82cr-hjcx","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-crvj-82cr-hjcx","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-24","epss":0.00448,"percentile":0.38015}],"risk":0.24416,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx","https://nvd.nist.gov/vuln/detail/CVE-2026-84363","https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crvj-82cr-hjcx","description":"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials"},"relatedVulnerabilities":[{"id":"CVE-2026-84363","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-24","epss":0.00448,"percentile":0.38015}],"urls":["https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84363","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"b5ec402032a70d94","cpes":["cpe:2.3:a:BinaryMuse:toml:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:4.2.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9j65-hcg3-gc64","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-9j65-hcg3-gc64","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114143","date":"2026-10-24","epss":0.00291,"percentile":0.20643}],"risk":0.23570999999999995,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://nvd.nist.gov/vuln/detail/CVE-2026-114143","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","description":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114143","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114143","date":"2026-10-24","epss":0.00291,"percentile":0.20643}],"urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"b5ec402032a70d94","cpes":["cpe:2.3:a:BinaryMuse:toml:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:toml:toml:4.2.0:*:*:*:*:*:*:*"],"name":"toml","purl":"pkg:npm/toml@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/toml@4.2.0/node_modules/toml/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qx8-w7c3-pj3p","versionConstraint":"<=5.0.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"toml","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qx8-w7c3-pj3p","fix":{"state":"fixed","versions":["5.0.1"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"5.0.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114141","date":"2026-10-24","epss":0.00291,"percentile":0.20641}],"risk":0.23570999999999995,"urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p","https://nvd.nist.gov/vuln/detail/CVE-2026-114141","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","description":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()"},"relatedVulnerabilities":[{"id":"CVE-2026-114141","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-114141","date":"2026-10-24","epss":0.00291,"percentile":0.20641}],"urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-24","epss":0.00386,"percentile":0.31514}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-24","epss":0.00386,"percentile":0.31514}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","fix":{"state":"fixed","versions":["14.2.0"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"14.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-24","epss":0.00432,"percentile":0.36413}],"risk":0.22248000000000004,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations"},"relatedVulnerabilities":[{"id":"CVE-2026-48988","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-24","epss":0.00432,"percentile":0.36413}],"urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-24","epss":0.00386,"percentile":0.31514}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-24","epss":0.00386,"percentile":0.31514}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-24","epss":0.00396,"percentile":0.32658}],"risk":0.21384,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","description":"qs: Denial of Service via Attacker Controlled isBuffer"},"relatedVulnerabilities":[{"id":"CVE-2026-82417","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-24","epss":0.00396,"percentile":0.32658}],"urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-24","epss":0.0037,"percentile":0.29774}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-24","epss":0.0037,"percentile":0.29774}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-24","epss":0.00428,"percentile":0.36057}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ab5593bbdf9ba16a","cpes":["cpe:2.3:a:momentjs:moment:2.30.1:*:*:*:*:node.js:*:*"],"name":"moment","purl":"pkg:npm/moment@2.30.1","type":"npm","version":"2.30.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"moment","version":"2.30.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-24","epss":0.00357,"percentile":0.28248}],"risk":0.194565,"urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","description":"moment vulnerable to Path Traversal via crafted non-string locale name"},"relatedVulnerabilities":[{"id":"CVE-2026-17495","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-24","epss":0.00357,"percentile":0.28248}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale()."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22g5-r2x5-97cx","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22g5-r2x5-97cx","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-24","epss":0.00338,"percentile":0.2605}],"risk":0.18083,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59710","https://github.com/showdownjs/showdown/issues/1046","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22g5-r2x5-97cx","description":"showdown allows stored cross-site scripting through table header ID injection"},"relatedVulnerabilities":[{"id":"CVE-2026-59710","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-24","epss":0.00338,"percentile":0.2605}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown/issues/1046","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59710","description":"showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration."}]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x3q4-9hxx-gx8m","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x3q4-9hxx-gx8m","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113654","date":"2026-10-24","epss":0.00349,"percentile":0.27299}],"risk":0.179735,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","description":"ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render"},"relatedVulnerabilities":[{"id":"CVE-2026-113654","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113654","date":"2026-10-24","epss":0.00349,"percentile":0.27299}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113654","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"ecd3512b2296d0af","cpes":["cpe:2.3:a:nodejs:undici:6.28.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.1","type":"npm","version":"6.28.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:a5268dfebd2a4648e3636d70f10503884965334ab0b68ee4cae2560bbc1caf1e","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=6.5.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"risk":0.17494500000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"},"relatedVulnerabilities":[{"id":"CVE-2026-109924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"5818e0dae407ee67","cpes":["cpe:2.3:a:nodejs:undici:6.29.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.29.0","type":"npm","version":"6.29.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@6.29.0/node_modules/undici/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@6.29.0/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.29.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=6.5.0,<6.29.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.29.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","fix":{"state":"fixed","versions":["6.29.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"6.29.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"risk":0.17494500000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"},"relatedVulnerabilities":[{"id":"CVE-2026-109924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"risk":0.17494500000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"},"relatedVulnerabilities":[{"id":"CVE-2026-109924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109924","date":"2026-10-24","epss":0.00321,"percentile":0.23875}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cr32-g25g-vxjj","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cr32-g25g-vxjj","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-24","epss":0.00327,"percentile":0.24595}],"risk":0.17494499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59711","https://github.com/showdownjs/showdown/issues/1047","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument","https://github.com/showdownjs/showdown/commit/184a3e4e97f90e075c4512f2c4c06dcf655e91b7"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cr32-g25g-vxjj","description":"showdown metadata title handling allows cross-site scripting"},"relatedVulnerabilities":[{"id":"CVE-2026-59711","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-24","epss":0.00327,"percentile":0.24595}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/issues/1047","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59711","description":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-24","epss":0.00301,"percentile":0.21741}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-24","epss":0.00301,"percentile":0.21741}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"fe532cb68c64ada4","cpes":["cpe:2.3:a:strukturag:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:strukturag:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde265:libde:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde265:1.1.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libde:libde:1.1.1-r0:*:*:*:*:*:*:*"],"name":"libde265","purl":"pkg:apk/alpine/libde265@1.1.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.1.1-r0","language":"","licenses":["LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libde265.so.0"},{"path":"/usr/lib/libde265.so.0.2.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libde265"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49337","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49337","versionConstraint":"< 1.1.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"libde265","version":"1.1.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-49337","fix":{"state":"fixed","versions":["1.1.3-r0"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"1.1.3-r0"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49337","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49337","date":"2026-10-24","epss":0.00327,"percentile":0.24639}],"risk":0.152055,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-49337"},"relatedVulnerabilities":[{"id":"CVE-2026-49337","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49337","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-49337","date":"2026-10-24","epss":0.00327,"percentile":0.24639}],"urls":["https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9","https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49337","description":"libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object\nthat has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","fix":{"state":"fixed","versions":["10.7.4"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-24","epss":0.00253,"percentile":0.15889}],"risk":0.142945,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"},"relatedVulnerabilities":[{"id":"CVE-2026-111997","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-24","epss":0.00253,"percentile":0.15889}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."}]},{"artifact":{"id":"cd18d43b0cb2b261","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.7.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.7.1","type":"npm","version":"10.7.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:a5268dfebd2a4648e3636d70f10503884965334ab0b68ee4cae2560bbc1caf1e","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.7.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","fix":{"state":"fixed","versions":["10.7.4"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"10.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-24","epss":0.00253,"percentile":0.15889}],"risk":0.142945,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"},"relatedVulnerabilities":[{"id":"CVE-2026-111997","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-111997","date":"2026-10-24","epss":0.00253,"percentile":0.15889}],"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."}]},{"artifact":{"id":"7772b4d6519da701","cpes":["cpe:2.3:a:element-plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element-plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element_plus:2.4.3:*:*:*:*:*:*:*"],"name":"element-plus","purl":"pkg:npm/element-plus@2.4.3","type":"npm","version":"2.4.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5m5x-9j46-h678","versionConstraint":"<=2.11.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"element-plus","version":"2.4.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5m5x-9j46-h678","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-24","epss":0.00236,"percentile":0.13842}],"risk":0.13688,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-57665","https://github.com/element-plus/element-plus/pull/21711","https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://www.npmjs.com/package/element-plus","https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5m5x-9j46-h678","description":"Element Plus Link component (el-link) implements insufficient input validation for the href attribute"},"relatedVulnerabilities":[{"id":"CVE-2025-57665","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-24","epss":0.00236,"percentile":0.13842}],"urls":["https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://github.com/element-plus/element-plus/pull/21711","https://www.npmjs.com/package/element-plus"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57665","description":"Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs."}]},{"artifact":{"id":"95d5b8e7a413027a","cpes":["cpe:2.3:a:nodejs:undici:7.29.1:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@7.29.1","type":"npm","version":"7.29.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/undici@7.29.1/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.30.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f72v-6w45-q472","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"7.29.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-f72v-6w45-q472","fix":{"state":"fixed","versions":["7.30.1"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"7.30.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109841","date":"2026-10-24","epss":0.00251,"percentile":0.15731}],"risk":0.13679500000000003,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f72v-6w45-q472","description":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens"},"relatedVulnerabilities":[{"id":"CVE-2026-109841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-109841","date":"2026-10-24","epss":0.00251,"percentile":0.15731}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata."}]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cv27-6wvh-8x7j","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cv27-6wvh-8x7j","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113661","date":"2026-10-24","epss":0.00263,"percentile":0.17191}],"risk":0.13676,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","description":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs"},"relatedVulnerabilities":[{"id":"CVE-2026-113661","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113661","date":"2026-10-24","epss":0.00263,"percentile":0.17191}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113661","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","fix":{"state":"fixed","versions":["14.3.3"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"14.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111766","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111766","date":"2026-10-24","epss":0.0035,"percentile":0.27477}],"risk":0.11725,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled"},"relatedVulnerabilities":[{"id":"CVE-2026-111766","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111766","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111766","date":"2026-10-24","epss":0.0035,"percentile":0.27477}],"urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5r4p-p66f-jhc7","versionConstraint":">=4.12.4,<4.13.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","fix":{"state":"fixed","versions":["4.13.11"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"4.13.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-24","epss":0.00223,"percentile":0.12218}],"risk":0.114845,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","https://nvd.nist.gov/vuln/detail/CVE-2026-111757","https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/releases/tag/v4.13.11"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths"},"relatedVulnerabilities":[{"id":"CVE-2026-111757","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-24","epss":0.00223,"percentile":0.12218}],"urls":["https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110306","cwe":"CWE-180","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110306","date":"2026-10-24","epss":0.00204,"percentile":0.09876}],"risk":0.11321999999999999,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding"},"relatedVulnerabilities":[{"id":"CVE-2026-110306","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110306","cwe":"CWE-180","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110306","date":"2026-10-24","epss":0.00204,"percentile":0.09876}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","fix":{"state":"fixed","versions":["4.13.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"4.13.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-24","epss":0.00227,"percentile":0.12811}],"risk":0.11009499999999998,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS"},"relatedVulnerabilities":[{"id":"CVE-2026-93981","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-24","epss":0.00227,"percentile":0.12811}],"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin."}]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-374f-7chj-9948","versionConstraint":">=2.17.7,<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-374f-7chj-9948","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113657","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113657","date":"2026-10-24","epss":0.00313,"percentile":0.23036}],"risk":0.10485499999999999,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-374f-7chj-9948","description":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)"},"relatedVulnerabilities":[{"id":"CVE-2026-113657","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113657","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113657","date":"2026-10-24","epss":0.00313,"percentile":0.23036}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113657","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=3.1.3,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110180","cwe":"CWE-436","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110180","date":"2026-10-24","epss":0.00208,"percentile":0.10415}],"risk":0.10191999999999998,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization"},"relatedVulnerabilities":[{"id":"CVE-2026-110180","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110180","cwe":"CWE-436","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110180","date":"2026-10-24","epss":0.00208,"percentile":0.10415}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mjw6-4jj6-33hc","versionConstraint":"<3.6.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mjw6-4jj6-33hc","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-24","epss":0.00195,"percentile":0.08735}],"risk":0.098475,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc","https://nvd.nist.gov/vuln/detail/CVE-2026-104183","https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mjw6-4jj6-33hc","description":"stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects"},"relatedVulnerabilities":[{"id":"CVE-2026-104183","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-24","epss":0.00195,"percentile":0.08735}],"urls":["https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104183","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-528h-pc64-c93x","versionConstraint":"<=3.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-528h-pc64-c93x","fix":{"state":"fixed","versions":["3.5.0"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"3.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-24","epss":0.0016,"percentile":0.04858}],"risk":0.08960000000000001,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-528h-pc64-c93x","description":"stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-71429","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-24","epss":0.0016,"percentile":0.04858}],"urls":["https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6","https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71429","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-24","epss":0.00171,"percentile":0.06131}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-333x-w4r6-6crp","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110725","cwe":"CWE-116","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110725","date":"2026-10-24","epss":0.00254,"percentile":0.16076}],"risk":0.08509,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references"},"relatedVulnerabilities":[{"id":"CVE-2026-110725","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-110725","cwe":"CWE-116","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110725","date":"2026-10-24","epss":0.00254,"percentile":0.16076}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f7f05c9db71974e4df740941308ffc92158970f0a8fe556c07a4f42112b520e3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-24","epss":0.00186,"percentile":0.07791}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"ea82d1833f17b5c5","cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"name":"fast-uri","purl":"pkg:npm/fast-uri@3.1.8","type":"npm","version":"3.1.8","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.1.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"fast-uri","version":"3.1.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","fix":{"state":"fixed","versions":["3.1.9"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"3.1.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110095","date":"2026-10-24","epss":0.00232,"percentile":0.13331}],"risk":0.07772,"urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","description":"fast-uri vulnerable to improper path equivalence in relative reference normalization"},"relatedVulnerabilities":[{"id":"CVE-2026-110095","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-110095","date":"2026-10-24","epss":0.00232,"percentile":0.13331}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hqr4-qq8f-hg3x","versionConstraint":"<=3.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hqr4-qq8f-hg3x","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-24","epss":0.00138,"percentile":0.02936}],"risk":0.07728,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x","https://nvd.nist.gov/vuln/detail/CVE-2026-104182","https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hqr4-qq8f-hg3x","description":"stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk"},"relatedVulnerabilities":[{"id":"CVE-2026-104182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-24","epss":0.00138,"percentile":0.02936}],"urls":["https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104182","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"ea76f17754cba393","cpes":["cpe:2.3:a:\\@langchain\\/redis:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/redis","purl":"pkg:npm/%40langchain/redis@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x6v-p487-7qh2","versionConstraint":"<=1.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/redis","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5x6v-p487-7qh2","fix":{"state":"fixed","versions":["1.1.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-24","epss":0.00278,"percentile":0.19278}],"risk":0.07367,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2","https://nvd.nist.gov/vuln/detail/CVE-2026-105799","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x6v-p487-7qh2","description":"LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values"},"relatedVulnerabilities":[{"id":"CVE-2026-105799","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-24","epss":0.00278,"percentile":0.19278}],"urls":["https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105799","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1."}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=1.3.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46jr-4wx8-v453","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"},"relatedVulnerabilities":[{"id":"CVE-2026-111768","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46jr-4wx8-v453","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"},"relatedVulnerabilities":[{"id":"CVE-2026-111768","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jm63-cq47-j5jp","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jm63-cq47-j5jp","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp","https://github.com/modelcontextprotocol/typescript-sdk/pull/2918","https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jm63-cq47-j5jp","description":"MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another"},"relatedVulnerabilities":[{"id":"CVE-2026-111770","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6prh-2h8m-c8cw","versionConstraint":"<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6prh-2h8m-c8cw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","description":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-111769","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=1.6.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service"},"relatedVulnerabilities":[{"id":"CVE-2026-111771","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service"},"relatedVulnerabilities":[{"id":"CVE-2026-111771","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-253c-mchw-3w2r","fix":{"state":"fixed","versions":["14.3.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"14.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds"},"relatedVulnerabilities":[]},{"artifact":{"id":"0e9d26b193d9fb92","cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.14:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@10.0.14","type":"npm","version":"10.0.14","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-85x2-q946-cp5h","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"10.0.14"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-85x2-q946-cp5h","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-85x2-q946-cp5h","description":"Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name"},"relatedVulnerabilities":[]},{"artifact":{"id":"0e9d26b193d9fb92","cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.14:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@10.0.14","type":"npm","version":"10.0.14","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c8m-p3m8-cjg8","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"10.0.14"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8c8m-p3m8-cjg8","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","description":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient"},"relatedVulnerabilities":[]},{"artifact":{"id":"0e9d26b193d9fb92","cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.14:*:*:*:*:node.js:*:*"],"name":"nodemailer","purl":"pkg:npm/nodemailer@10.0.14","type":"npm","version":"10.0.14","language":"javascript","licenses":["MIT-0"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","layerID":"sha256:d654cbf09af9b79afe43867640bde70b416b323281625c87cf883786dd609332","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/nodemailer@10.0.14/node_modules/nodemailer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m943-m63m-w62w","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"nodemailer","version":"10.0.14"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m943-m63m-w62w","fix":{"state":"fixed","versions":["10.1.4"],"available":[{"date":"2026-10-24","kind":"first-observed","version":"10.1.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m943-m63m-w62w","description":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-26T06:19:32.451Z","grype_db_version":"2026-10-25T06:27:34.000Z"}