{"grype_matches":[{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2007-0770","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2007-0770","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-0770","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2007-0770","date":"2026-10-20","epss":0.05403,"percentile":0.9261}],"risk":4.538520000000001,"urls":["http://secunia.com/advisories/24167","http://secunia.com/advisories/24196","http://www.debian.org/security/2007/dsa-1260","http://www.mandriva.com/security/advisories?name=MDKSA-2007:041","http://www.novell.com/linux/security/advisories/2007_3_sr.html","http://www.osvdb.org/31911","http://www.securityfocus.com/archive/1/459507/100/0/threaded","http://www.ubuntu.com/usn/usn-422-1","https://issues.rpath.com/browse/RPL-1034"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-0770","description":"Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456."},"relatedVulnerabilities":[]},{"artifact":{"id":"e62318d2e7910b78","cpes":["cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*"],"name":"braces","purl":"pkg:npm/braces@3.0.3","type":"npm","version":"3.0.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/braces@3.0.3/node_modules/braces/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/braces@3.0.3/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfj7-8cjw-p6xm","versionConstraint":"<=3.0.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"braces","version":"3.0.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vfj7-8cjw-p6xm","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93687","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93687","date":"2026-10-20","epss":0.00757,"percentile":0.54417}],"risk":0.59046,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93687","https://github.com/micromatch/braces/issues/70","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfj7-8cjw-p6xm","description":"braces vulnerable to stack-exhaustion denial of service through deeply nested patterns"},"relatedVulnerabilities":[{"id":"CVE-2026-93687","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93687","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93687","date":"2026-10-20","epss":0.00757,"percentile":0.54417}],"urls":["https://github.com/micromatch/braces","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://github.com/micromatch/braces/issues/70","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns","https://github.com/micromatch/braces/issues/73#issuecomment-5996574974"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93687","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","fix":{"state":"fixed","versions":["14.3.2"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"14.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111759","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111759","date":"2026-10-20","epss":0.00598,"percentile":0.4766}],"risk":0.4485,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes"},"relatedVulnerabilities":[{"id":"CVE-2026-111759","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111759","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111759","date":"2026-10-20","epss":0.00598,"percentile":0.4766}],"urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2."}]},{"artifact":{"id":"c87764051de550d7","cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:4.2.0:*:*:*:*:node.js:*:*"],"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics@4.2.0","type":"npm","version":"4.2.0","language":"javascript","licenses":["BSD-2-Clause"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ch52-4w7c-c8xp","versionConstraint":"<=4.2.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"http-cache-semantics","version":"4.2.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-ch52-4w7c-c8xp","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-20","epss":0.00569,"percentile":0.46095}],"risk":0.44382,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ch52-4w7c-c8xp","description":"http-cache-semantics max-stale handling can disclose cross-user cached responses"},"relatedVulnerabilities":[{"id":"CVE-2026-93748","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93748","cwe":"CWE-524","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93748","date":"2026-10-20","epss":0.00569,"percentile":0.46095}],"urls":["https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://github.com/kornelski/http-cache-semantics/issues/56","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale","https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748","description":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons."}]},{"artifact":{"id":"a98af2947586979d","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-20","epss":0.00549,"percentile":0.44879}],"risk":0.43371,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-20","epss":0.00549,"percentile":0.44879}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"34a0a5e3ece0fdd0","cpes":["cpe:2.3:a:libtiff:libtiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:libtiff:tiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:tiff:libtiff:4.7.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:tiff:tiff:4.7.1-r0:*:*:*:*:*:*:*"],"name":"tiff","purl":"pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"4.7.1-r0","language":"","licenses":["libtiff"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libtiff.so.6"},{"path":"/usr/lib/libtiff.so.6.2.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tiff"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.7.2-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"< 4.7.2-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"tiff","version":"4.7.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"4.7.2-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"< 4.7.2-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"tiff","version":"4.7.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"fixed","versions":["4.7.2-r0"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"4.7.2-r0"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-20","epss":0.00553,"percentile":0.45153}],"risk":0.423045,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-20","epss":0.00553,"percentile":0.45153}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmmh-p597-ppvv","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rmmh-p597-ppvv","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-20","epss":0.00806,"percentile":0.56104}],"risk":0.41509,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-1899","https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmmh-p597-ppvv","description":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"},"relatedVulnerabilities":[{"id":"CVE-2024-1899","cvss":[{"type":"Secondary","source":"vulnreport@tenable.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1899","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-1899","date":"2026-10-20","epss":0.00806,"percentile":0.56104}],"urls":["https://www.tenable.com/security/research/tra-2024-05"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1899","description":"An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38c4-r59v-3vqw","versionConstraint":">=13.0.0,<14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-38c4-r59v-3vqw","fix":{"state":"fixed","versions":["14.1.1"],"available":[{"date":"2026-03-04","kind":"first-observed","version":"14.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-20","epss":0.00739,"percentile":0.53785}],"risk":0.38428,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2327","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","description":"markdown-it is has a Regular Expression Denial of Service (ReDoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-2327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","type":"Secondary","source":"report@snyk.io"}],"epss":[{"cve":"CVE-2026-2327","date":"2026-10-20","epss":0.00739,"percentile":0.53785}],"urls":["https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition."}]},{"artifact":{"id":"340925abcfb4f680","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-20","epss":0.00436,"percentile":0.36598}],"risk":0.34225999999999995,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-20","epss":0.00436,"percentile":0.36598}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"e2cc73391186523d","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-20","epss":0.00436,"percentile":0.36598}],"risk":0.34225999999999995,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers"},"relatedVulnerabilities":[{"id":"CVE-2026-111755","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111755","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111755","date":"2026-10-20","epss":0.00436,"percentile":0.36598}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1."}]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rfgv-xxqx-mfg5","versionConstraint":">=6.7.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rfgv-xxqx-mfg5","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-20","epss":0.00394,"percentile":0.32145}],"risk":0.29550000000000004,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534","https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5","description":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol"},"relatedVulnerabilities":[{"id":"CVE-2026-19534","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-19534","cwe":"CWE-252","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-19534","date":"2026-10-20","epss":0.00394,"percentile":0.32145}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"5a0f4c103779f950","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1.3.2-r1"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.3.2-r1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-20","epss":0.00356,"percentile":0.2784}],"risk":0.28124,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-20","epss":0.00356,"percentile":0.2784}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"9361a461f1bc8b3d","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47-r0:*:*:*:*:*:*:*"],"name":"graphicsmagick","purl":"pkg:apk/alpine/graphicsmagick@1.3.47-r0?arch=x86_64&distro=alpine-3.24","type":"apk","version":"1.3.47-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gm"},{"path":"/usr/lib"},{"path":"/usr/lib/libGraphicsMagick.la"},{"path":"/usr/lib/libGraphicsMagick.so.3"},{"path":"/usr/lib/libGraphicsMagick.so.3.27.0"},{"path":"/usr/lib/libGraphicsMagickWand.la"},{"path":"/usr/lib/libGraphicsMagickWand.so.2"},{"path":"/usr/lib/libGraphicsMagickWand.so.2.11.0"},{"path":"/usr/lib/GraphicsMagick-1.3.47"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/delegates.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-ghostscript.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-solaris.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-urw-base35-otf.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type-windows.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/config/type.mgk"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/aai.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/art.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/avs.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/bmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/braille.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cals.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/caption.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cineon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cmyk.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/cut.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dcraw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dib.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/dpx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ept.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fax.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/fits.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gradient.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/gray.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/heif.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/histogram.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/hrz.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/html.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/icon.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/identity.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/info.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jnx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/jpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/label.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/locale.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/logo.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mac.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/map.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mat.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/matte.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/meta.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/miff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mono.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpeg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mpr.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/msl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mtv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/mvg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/null.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/otb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/palm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcd.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcl.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pcx.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pdf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pict.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pix.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/plasma.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/png.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pnm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/preview.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps2.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ps3.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/pwp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rgb.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rla.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/rle.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sct.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sfw.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sgi.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/stegano.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/sun.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/svg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tga.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tiff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tile.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/tim.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/topol.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/ttf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/txt.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uil.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/url.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/uyvy.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vicar.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/vid.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/viff.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wbmp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/webp.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wmf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/wpg.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xbm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xc.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xcf.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/xpm.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/coders/yuv.so"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.la"},{"path":"/usr/lib/GraphicsMagick-1.3.47/modules-Q16/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/GraphicsMagick-1.3.47"},{"path":"/usr/share/GraphicsMagick-1.3.47/config"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/colors.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/log.mgk"},{"path":"/usr/share/GraphicsMagick-1.3.47/config/modules.mgk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"graphicsmagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-32460","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.47:*:*:*:*:*:*:*"],"package":{"name":"graphicsmagick","version":"1.3.47-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-32460","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32460","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32460","date":"2026-10-20","epss":0.00359,"percentile":0.28295}],"risk":0.2791225,"urls":["https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb","https://issues.oss-fuzz.com/issues/406320404","https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32460","description":"GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfdc4678d94e94f6","cpes":["cpe:2.3:a:multer:multer:2.3.0:*:*:*:*:*:*:*"],"name":"multer","purl":"pkg:npm/multer@2.3.0","type":"npm","version":"2.3.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/multer@2.3.0/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pph-fpjx-jg34","versionConstraint":">=2.2.0,<2.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"multer","version":"2.3.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3pph-fpjx-jg34","fix":{"state":"fixed","versions":["2.4.0"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-20","epss":0.00532,"percentile":0.43824}],"risk":0.27398,"urls":["https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34","https://nvd.nist.gov/vuln/detail/CVE-2026-88932","https://github.com/expressjs/multer/commit/53337f9713619ef3381ee6b4e541f926dbaac305","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/releases/tag/v2.4.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","description":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads"},"relatedVulnerabilities":[{"id":"CVE-2026-88932","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88932","cwe":"CWE-400","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"cve":"CVE-2026-88932","cwe":"CWE-459","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-88932","date":"2026-10-20","epss":0.00532,"percentile":0.43824}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","description":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g6gw-c38x-mqfc","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-g6gw-c38x-mqfc","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-20","epss":0.00529,"percentile":0.43632}],"risk":0.27243500000000004,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc","https://nvd.nist.gov/vuln/detail/CVE-2026-84364","https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g6gw-c38x-mqfc","description":"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-84364","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84364","date":"2026-10-20","epss":0.00529,"percentile":0.43632}],"urls":["https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84364","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-20","epss":0.0054,"percentile":0.44351}],"risk":0.27,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","description":"qs array-limit bypass via bracket-key comma parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-82562","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82562","date":"2026-10-20","epss":0.0054,"percentile":0.44351}],"urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","fix":{"state":"fixed","versions":["5.0.10"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-20","epss":0.0035,"percentile":0.27235}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102276","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102276","date":"2026-10-20","epss":0.0035,"percentile":0.27235}],"urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","fix":{"state":"fixed","versions":["5.0.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-20","epss":0.0035,"percentile":0.27233}],"risk":0.2625,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-102278","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102278","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102278","date":"2026-10-20","epss":0.0035,"percentile":0.27233}],"urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11."}]},{"artifact":{"id":"9efa366ab366f908","cpes":["cpe:2.3:a:\\@langchain\\/mongodb:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/mongodb:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/mongodb","purl":"pkg:npm/%40langchain/mongodb@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+mongodb@1.0.1_@aws-sdk+credential-providers@3.808.0_@langchain+core@1.2.8_@o_b0bbf785bb992216d041cc6a270728fb/node_modules/@langchain/mongodb/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6rx-h84q-8r95","versionConstraint":"<=1.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/mongodb","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m6rx-h84q-8r95","fix":{"state":"fixed","versions":["1.3.1"],"available":[{"date":"2026-10-09","kind":"first-observed","version":"1.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-20","epss":0.00463,"percentile":0.38821}],"risk":0.25465000000000004,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","https://nvd.nist.gov/vuln/detail/CVE-2026-106119","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","description":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"},"relatedVulnerabilities":[{"id":"CVE-2026-106119","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106119","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106119","date":"2026-10-20","epss":0.00463,"percentile":0.38821}],"urls":["https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gqvv-2mrq-wpjv","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-gqvv-2mrq-wpjv","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-20","epss":0.00437,"percentile":0.3669}],"risk":0.25127499999999997,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","description":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory"},"relatedVulnerabilities":[{"id":"CVE-2026-84365","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84365","date":"2026-10-20","epss":0.00437,"percentile":0.3669}],"urls":["https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84365","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crvj-82cr-hjcx","versionConstraint":"<4.13.5 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-crvj-82cr-hjcx","fix":{"state":"fixed","versions":["4.13.5"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.13.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-20","epss":0.00448,"percentile":0.37648}],"risk":0.24416,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx","https://nvd.nist.gov/vuln/detail/CVE-2026-84363","https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crvj-82cr-hjcx","description":"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials"},"relatedVulnerabilities":[{"id":"CVE-2026-84363","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84363","date":"2026-10-20","epss":0.00448,"percentile":0.37648}],"urls":["https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84363","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"risk":0.22967,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-101910","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101910","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"fde10c1d4bbab706","cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@6.15.2","type":"npm","version":"6.15.2","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/qs@6.15.2/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.16.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"6.15.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","fix":{"state":"fixed","versions":["6.16.0"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"6.16.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-20","epss":0.00418,"percentile":0.34753}],"risk":0.22572,"urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","description":"qs: Denial of Service via Attacker Controlled isBuffer"},"relatedVulnerabilities":[{"id":"CVE-2026-82417","cvss":[{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"cve":"CVE-2026-82417","cwe":"CWE-703","type":"Secondary","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}],"epss":[{"cve":"CVE-2026-82417","date":"2026-10-20","epss":0.00418,"percentile":0.34753}],"urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs."}]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3wwx-pv8p-q78v","versionConstraint":">=6.25.0,<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3wwx-pv8p-q78v","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-20","epss":0.00412,"percentile":0.34098}],"risk":0.22454000000000002,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3wwx-pv8p-q78v","description":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"},"relatedVulnerabilities":[{"id":"CVE-2026-85024","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-85024","date":"2026-10-20","epss":0.00412,"percentile":0.34098}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","description":"undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","fix":{"state":"fixed","versions":["14.2.0"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"14.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-20","epss":0.00432,"percentile":0.3609}],"risk":0.22248000000000004,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations"},"relatedVulnerabilities":[{"id":"CVE-2026-48988","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48988","date":"2026-10-20","epss":0.00432,"percentile":0.3609}],"urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","fix":{"state":"fixed","versions":["10.5.1"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"10.5.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"risk":0.21809,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts"},"relatedVulnerabilities":[{"id":"CVE-2026-101913","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101913","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101913","date":"2026-10-20","epss":0.00386,"percentile":0.31217}],"urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1."}]},{"artifact":{"id":"6d0797d2a380fcd0","cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:7.1.4:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:7.1.4:*:*:*:*:*:*:*"],"name":"postcss-selector-parser","purl":"pkg:npm/postcss-selector-parser@7.1.4","type":"npm","version":"7.1.4","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/postcss-selector-parser/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<7.1.6 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"postcss-selector-parser","version":"7.1.4"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","fix":{"state":"fixed","versions":["7.1.6"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"7.1.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-20","epss":0.00394,"percentile":0.32112}],"risk":0.21473,"urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-104844","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-104844","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104844","date":"2026-10-20","epss":0.00394,"percentile":0.32112}],"urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-20","epss":0.0037,"percentile":0.29492}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-20","epss":0.0037,"percentile":0.29492}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-20","epss":0.0037,"percentile":0.29492}],"risk":0.20904999999999999,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"},"relatedVulnerabilities":[{"id":"CVE-2026-101912","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101912","cwe":"CWE-843","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101912","date":"2026-10-20","epss":0.0037,"percentile":0.29492}],"urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-20","epss":0.00428,"percentile":0.3574}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ab5593bbdf9ba16a","cpes":["cpe:2.3:a:momentjs:moment:2.30.1:*:*:*:*:node.js:*:*"],"name":"moment","purl":"pkg:npm/moment@2.30.1","type":"npm","version":"2.30.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/moment@2.30.1/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"moment","version":"2.30.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","fix":{"state":"fixed","versions":["2.31.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-20","epss":0.00357,"percentile":0.27959}],"risk":0.194565,"urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","description":"moment vulnerable to Path Traversal via crafted non-string locale name"},"relatedVulnerabilities":[{"id":"CVE-2026-17495","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-17495","date":"2026-10-20","epss":0.00357,"percentile":0.27959}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale()."}]},{"artifact":{"id":"a98af2947586979d","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-20","epss":0.00348,"percentile":0.26994}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-20","epss":0.00348,"percentile":0.26994}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22g5-r2x5-97cx","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22g5-r2x5-97cx","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-20","epss":0.00338,"percentile":0.25779}],"risk":0.18083,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59710","https://github.com/showdownjs/showdown/issues/1046","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22g5-r2x5-97cx","description":"showdown allows stored cross-site scripting through table header ID injection"},"relatedVulnerabilities":[{"id":"CVE-2026-59710","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59710","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59710","date":"2026-10-20","epss":0.00338,"percentile":0.25779}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown/issues/1046","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59710","description":"showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration."}]},{"artifact":{"id":"93f929590853fc8f","cpes":["cpe:2.3:a:showdownjs:showdown:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:showdown:showdown:2.1.0:*:*:*:*:*:*:*"],"name":"showdown","purl":"pkg:npm/showdown@2.1.0","type":"npm","version":"2.1.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/showdown@2.1.0/node_modules/showdown/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cr32-g25g-vxjj","versionConstraint":"<=2.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"showdown","version":"2.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cr32-g25g-vxjj","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-20","epss":0.00327,"percentile":0.24334}],"risk":0.17494499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-59711","https://github.com/showdownjs/showdown/issues/1047","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument","https://github.com/showdownjs/showdown/commit/184a3e4e97f90e075c4512f2c4c06dcf655e91b7"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cr32-g25g-vxjj","description":"showdown metadata title handling allows cross-site scripting"},"relatedVulnerabilities":[{"id":"CVE-2026-59711","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59711","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-59711","date":"2026-10-20","epss":0.00327,"percentile":0.24334}],"urls":["https://github.com/showdownjs/showdown","https://github.com/showdownjs/showdown/issues/1047","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59711","description":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page."}]},{"artifact":{"id":"ee4435d9da2328c8","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"aa86ffe12b42801d","cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"name":"ip-address","purl":"pkg:npm/ip-address@10.3.1","type":"npm","version":"10.3.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/ip-address@10.3.1/node_modules/ip-address/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"ip-address","version":"10.3.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","fix":{"state":"fixed","versions":["10.7.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"10.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"risk":0.170065,"urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"},"relatedVulnerabilities":[{"id":"CVE-2026-101911","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-101911","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101911","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1."}]},{"artifact":{"id":"10dadf83fd0e284c","cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"name":"brace-expansion","purl":"pkg:npm/brace-expansion@5.0.9","type":"npm","version":"5.0.9","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"brace-expansion","version":"5.0.9"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","fix":{"state":"fixed","versions":["5.0.12"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"5.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"risk":0.15501500000000001,"urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-102277","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102277","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102277","date":"2026-10-20","epss":0.00301,"percentile":0.21508}],"urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12."}]},{"artifact":{"id":"7772b4d6519da701","cpes":["cpe:2.3:a:element-plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element-plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element_plus:element_plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element-plus:2.4.3:*:*:*:*:*:*:*","cpe:2.3:a:element:element_plus:2.4.3:*:*:*:*:*:*:*"],"name":"element-plus","purl":"pkg:npm/element-plus@2.4.3","type":"npm","version":"2.4.3","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/element-plus@2.4.3_patch_hash=95b9793afc4529bc887bf7dac437131975e133feb7152dce68aa4b3c9_f2e333df73e02df285fe0bca1f85e315/node_modules/element-plus/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5m5x-9j46-h678","versionConstraint":"<=2.11.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"element-plus","version":"2.4.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5m5x-9j46-h678","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-20","epss":0.00236,"percentile":0.13701}],"risk":0.13688,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-57665","https://github.com/element-plus/element-plus/pull/21711","https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://www.npmjs.com/package/element-plus","https://github.com/element-plus/element-plus/commit/110d4e1d7e150ccb829771c7319d31ce777d102f"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5m5x-9j46-h678","description":"Element Plus Link component (el-link) implements insufficient input validation for the href attribute"},"relatedVulnerabilities":[{"id":"CVE-2025-57665","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57665","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57665","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57665","date":"2026-10-20","epss":0.00236,"percentile":0.13701}],"urls":["https://element-plus.org/en-US/component/link.html","https://github.com/element-plus/element-plus","https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue","https://github.com/element-plus/element-plus/pull/21711","https://www.npmjs.com/package/element-plus"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57665","description":"Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs."}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","fix":{"state":"fixed","versions":["14.3.3"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"14.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111766","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111766","date":"2026-10-20","epss":0.0035,"percentile":0.27198}],"risk":0.11725,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled"},"relatedVulnerabilities":[{"id":"CVE-2026-111766","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111766","cwe":"CWE-407","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111766","date":"2026-10-20","epss":0.0035,"percentile":0.27198}],"urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5r4p-p66f-jhc7","versionConstraint":">=4.12.4,<4.13.11 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","fix":{"state":"fixed","versions":["4.13.11"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"4.13.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-20","epss":0.00223,"percentile":0.1208}],"risk":0.114845,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","https://nvd.nist.gov/vuln/detail/CVE-2026-111757","https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/releases/tag/v4.13.11"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths"},"relatedVulnerabilities":[{"id":"CVE-2026-111757","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-111757","date":"2026-10-20","epss":0.00223,"percentile":0.1208}],"urls":["https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11."}]},{"artifact":{"id":"f177012132788aa6","cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"name":"hono","purl":"pkg:npm/hono@4.12.34","type":"npm","version":"4.12.34","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/hono@4.12.34/node_modules/hono/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"hono","version":"4.12.34"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","fix":{"state":"fixed","versions":["4.13.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"4.13.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-20","epss":0.00227,"percentile":0.12676}],"risk":0.11009499999999998,"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS"},"relatedVulnerabilities":[{"id":"CVE-2026-93981","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93981","date":"2026-10-20","epss":0.00227,"percentile":0.12676}],"urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mjw6-4jj6-33hc","versionConstraint":"<3.6.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-mjw6-4jj6-33hc","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-20","epss":0.00195,"percentile":0.08681}],"risk":0.098475,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc","https://nvd.nist.gov/vuln/detail/CVE-2026-104183","https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mjw6-4jj6-33hc","description":"stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects"},"relatedVulnerabilities":[{"id":"CVE-2026-104183","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104183","cwe":"CWE-1321","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104183","date":"2026-10-20","epss":0.00195,"percentile":0.08681}],"urls":["https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104183","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.5.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-528h-pc64-c93x","versionConstraint":"<=3.4.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-528h-pc64-c93x","fix":{"state":"fixed","versions":["3.5.0"],"available":[{"date":"2026-09-04","kind":"first-observed","version":"3.5.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-20","epss":0.0016,"percentile":0.04835}],"risk":0.08960000000000001,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-528h-pc64-c93x","description":"stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-71429","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71429","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71429","date":"2026-10-20","epss":0.0016,"percentile":0.04835}],"urls":["https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6","https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71429","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0."}]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-20","epss":0.00171,"percentile":0.06081}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"bd20724e11749ab3","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r1:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r1?arch=x86_64&distro=alpine-3.24&upstream=coreutils","type":"apk","version":"9.11-r1","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:bbaa2349012e04eeceeb0d9f1c3f2fbe432637b97fbe9f8f252ea6a034c58ee3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-20","epss":0.00186,"percentile":0.07747}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1b9771ed454c8ce9","cpes":["cpe:2.3:a:nodejs:undici:6.28.0:*:*:*:*:node.js:*:*"],"name":"undici","purl":"pkg:npm/undici@6.28.0","type":"npm","version":"6.28.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/lib/node_modules/npm/node_modules/undici/package.json","layerID":"sha256:69ac650073d5fcbf0b5fd8f1a47290f16d64cdd9db69a8a6e0212444b0620b18","accessPath":"/usr/lib/node_modules/npm/node_modules/undici/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.28.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":"<6.28.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"undici","version":"6.28.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","fix":{"state":"fixed","versions":["6.28.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"6.28.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-20","epss":0.00239,"percentile":0.14075}],"risk":0.080065,"urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","description":"undici vulnerable to downstream response splitting via retry interceptor"},"relatedVulnerabilities":[{"id":"CVE-2026-18540","cvss":[{"type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","type":"Secondary","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"epss":[{"cve":"CVE-2026-18540","date":"2026-10-20","epss":0.00239,"percentile":0.14075}],"urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."}]},{"artifact":{"id":"de286a9b7e19b2a8","cpes":["cpe:2.3:a:stream-json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream-json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream_json:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:stream:stream_json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream-json:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:uhop:stream_json:1.9.1:*:*:*:*:*:*:*"],"name":"stream-json","purl":"pkg:npm/stream-json@1.9.1","type":"npm","version":"1.9.1","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/stream-json@1.9.1/node_modules/stream-json/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hqr4-qq8f-hg3x","versionConstraint":"<=3.5.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"stream-json","version":"1.9.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hqr4-qq8f-hg3x","fix":{"state":"fixed","versions":["3.6.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"3.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-20","epss":0.00138,"percentile":0.02906}],"risk":0.07728,"urls":["https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x","https://nvd.nist.gov/vuln/detail/CVE-2026-104182","https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hqr4-qq8f-hg3x","description":"stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk"},"relatedVulnerabilities":[{"id":"CVE-2026-104182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104182","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-104182","date":"2026-10-20","epss":0.00138,"percentile":0.02906}],"urls":["https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104182","description":"stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0."}]},{"artifact":{"id":"ea76f17754cba393","cpes":["cpe:2.3:a:\\@langchain\\/redis:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:langchain-ai:\\@langchain\\/redis:1.0.1:*:*:*:*:*:*:*"],"name":"@langchain/redis","purl":"pkg:npm/%40langchain/redis@1.0.1","type":"npm","version":"1.0.1","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@langchain+redis@1.0.1_@langchain+core@1.2.8_@opentelemetry+api@1.9.1_@opentelemetry+ex_74acf5db78bff69c6f1e7d995147ae6c/node_modules/@langchain/redis/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x6v-p487-7qh2","versionConstraint":"<=1.1.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@langchain/redis","version":"1.0.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-5x6v-p487-7qh2","fix":{"state":"fixed","versions":["1.1.1"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-20","epss":0.00278,"percentile":0.19069}],"risk":0.07367,"urls":["https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2","https://nvd.nist.gov/vuln/detail/CVE-2026-105799","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x6v-p487-7qh2","description":"LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values"},"relatedVulnerabilities":[{"id":"CVE-2026-105799","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105799","cwe":"CWE-943","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-105799","date":"2026-10-20","epss":0.00278,"percentile":0.19069}],"urls":["https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","https://github.com/langchain-ai/langchainjs/pull/10701","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105799","description":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1."}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-22jm-h49p-29qw","versionConstraint":">=1.24.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-22jm-h49p-29qw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-22jm-h49p-29qw","description":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them"},"relatedVulnerabilities":[{"id":"CVE-2026-111767","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111767","cwe":"CWE-862","type":"Primary","source":"security-advisories@github.com"}],"urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0."}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=1.3.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46jr-4wx8-v453","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"},"relatedVulnerabilities":[{"id":"CVE-2026-111768","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46jr-4wx8-v453","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation"},"relatedVulnerabilities":[{"id":"CVE-2026-111768","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jm63-cq47-j5jp","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-jm63-cq47-j5jp","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp","https://github.com/modelcontextprotocol/typescript-sdk/pull/2918","https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jm63-cq47-j5jp","description":"MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another"},"relatedVulnerabilities":[{"id":"CVE-2026-111770","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"340925abcfb4f680","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.4.3_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Primary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Primary","source":"security-advisories@github.com"}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"e2cc73391186523d","cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"name":"follow-redirects","purl":"pkg:npm/follow-redirects@1.16.0","type":"npm","version":"1.16.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/follow-redirects@1.16.0_debug@4.3.4_supports-color@8.1.1_/node_modules/follow-redirects/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"follow-redirects","version":"1.16.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","fix":{"state":"fixed","versions":["1.16.1"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.16.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Primary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping"},"relatedVulnerabilities":[{"id":"CVE-2026-111756","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-111756","cwe":"CWE-212","type":"Primary","source":"security-advisories@github.com"}],"urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6prh-2h8m-c8cw","versionConstraint":"<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-6prh-2h8m-c8cw","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","description":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-111769","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"b6268997ed1004fc","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.31.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk@1.31.0","type":"npm","version":"1.31.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+sdk@1.31.0_supports-color@8.1.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.32.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=1.6.0,<1.32.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/sdk","version":"1.31.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","fix":{"state":"fixed","versions":["1.32.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1.32.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service"},"relatedVulnerabilities":[{"id":"CVE-2026-111771","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"30e6471ea3fcd058","cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/server:\\@modelcontextprotocol\\/server:2.0.0:*:*:*:*:*:*:*"],"name":"@modelcontextprotocol/server","purl":"pkg:npm/%40modelcontextprotocol/server@2.0.0","type":"npm","version":"2.0.0","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.3.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"@modelcontextprotocol/server","version":"2.0.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","fix":{"state":"fixed","versions":["2.3.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.3.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service"},"relatedVulnerabilities":[{"id":"CVE-2026-111771","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"3b8f27c62542446d","cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.2:*:*:*:*:*:*:*"],"name":"markdown-it","purl":"pkg:npm/markdown-it@13.0.2","type":"npm","version":"13.0.2","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/markdown-it@13.0.2/node_modules/markdown-it/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"14.3.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"markdown-it","version":"13.0.2"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-253c-mchw-3w2r","fix":{"state":"fixed","versions":["14.3.1"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"14.3.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds"},"relatedVulnerabilities":[]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cv27-6wvh-8x7j","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-cv27-6wvh-8x7j","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","description":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs"},"relatedVulnerabilities":[{"id":"CVE-2026-113661","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113661","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-cv27-6wvh-8x7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113661","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x3q4-9hxx-gx8m","versionConstraint":"<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-x3q4-9hxx-gx8m","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","description":"ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render"},"relatedVulnerabilities":[{"id":"CVE-2026-113654","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113654","cwe":"CWE-79","type":"Primary","source":"security-advisories@github.com"}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113654","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0."}]},{"artifact":{"id":"1c6d2c226c0741b3","cpes":["cpe:2.3:a:sprintf-js:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf-js:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf_js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf-js:1.0.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf_js:1.0.3:*:*:*:*:*:*:*"],"name":"sprintf-js","purl":"pkg:npm/sprintf-js@1.0.3","type":"npm","version":"1.0.3","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.0.3/node_modules/sprintf-js/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.0.3/node_modules/sprintf-js/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hp3w-g68c-fv3c","versionConstraint":"<=1.1.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sprintf-js","version":"1.0.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hp3w-g68c-fv3c","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-97058","https://github.com/alexei/sprintf.js/issues/237","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90","https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hp3w-g68c-fv3c","description":"sprintf-js vulnerable to denial of service through unbounded precision specifiers"},"relatedVulnerabilities":[{"id":"CVE-2026-97058","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97058","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]},{"artifact":{"id":"94bdf0044f06b439","cpes":["cpe:2.3:a:sprintf-js:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf-js:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf_js:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:sprintf:sprintf_js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf-js:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:alexei:sprintf_js:1.1.3:*:*:*:*:*:*:*"],"name":"sprintf-js","purl":"pkg:npm/sprintf-js@1.1.3","type":"npm","version":"1.1.3","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hp3w-g68c-fv3c","versionConstraint":"<=1.1.3 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sprintf-js","version":"1.1.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hp3w-g68c-fv3c","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-97058","https://github.com/alexei/sprintf.js/issues/237","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17","https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90","https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision"],"severity":"Medium","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hp3w-g68c-fv3c","description":"sprintf-js vulnerable to denial of service through unbounded precision specifiers"},"relatedVulnerabilities":[{"id":"CVE-2026-97058","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97058","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]},{"artifact":{"id":"0b23dacb7dd10c07","cpes":["cpe:2.3:a:apostrophecms:sanitize-html:2.17.7:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:2.17.7:*:*:*:*:node.js:*:*"],"name":"sanitize-html","purl":"pkg:npm/sanitize-html@2.17.7","type":"npm","version":"2.17.7","language":"javascript","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","layerID":"sha256:970edbfe96a14d51bba0e96de295571d43c4ca609960db612b35a2a51ef1b363","accessPath":"/usr/local/lib/node_modules/n8n/node_modules/.pnpm/sanitize-html@2.17.7/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.18.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-374f-7chj-9948","versionConstraint":">=2.17.7,<2.18.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"sanitize-html","version":"2.17.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-374f-7chj-9948","fix":{"state":"fixed","versions":["2.18.0"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"2.18.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113657","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"risk":0,"urls":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":"Low","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-374f-7chj-9948","description":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)"},"relatedVulnerabilities":[{"id":"CVE-2026-113657","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113657","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"urls":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113657","description":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0."}]}],"grade":"F","score":"0.00","as_of":"2026-10-21T08:05:26.542Z","grype_db_version":"2026-10-21T06:31:02.000Z"}