{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-86f0-7c29-b126-898cd66cdedd", "CreatedAt": "2026-11-08T04:00:20.336798662+01:00", "ArtifactID": "sha256:cf3bdb22e0e62e64a7163e7bd89b9650db6b538c0673c0d2d44e9201e737abf5", "ArtifactName": "aiready-local-api", "ArtifactType": "container_image", "Metadata": { "Size": 770273792, "OS": { "Family": "alpine", "Name": "3.22.4" }, "ImageID": "sha256:e0676f98c8701f2b39707954875a558f11c5f6767f5df64ac8089f5204cbe0a0", "DiffIDs": [ "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0", "sha256:9072d322eb16c6a414861801ae295eb67839e0aeabeab982bea0520b6fccdeaa", "sha256:135be4fad03ab91972ef4eb6846e200938c2dea183881ba5cac3d79648a09737", "sha256:7a415decbb54be30a9369d7466887b96544eedd7b28dbb7ad87dc6381a4b91a0", "sha256:fb0c09554b3fc2d49fda0df4305e80bbd89a17e405ed02b65b79c54fcf6fd637", "sha256:592e878c2cd79244e9ecf582b4688c9fa9c45bb31b1890119e1fb88fae6a6784", "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71", "sha256:6a849c74dbba82e0169375be4b4f8020b6b3256ac5487e48cdbcd186e1040b1d", "sha256:b59fe7acbc9a7552ce6be816fdc697ac976acef593fe044ddd23d0874f874297", "sha256:eceb7e3e19a564b0acca63b6f57fd2c370ebf3eaec466f60515eb5a7f55e8272", "sha256:03bd984a7be57a030f4640c35e4f920a7b2073a936239f4e8df32d88ff82f391", "sha256:b7917fdb6764224cf26d8e35edccd08a40e9d202d740972f6bc5fc629b0a775a", "sha256:276b76411fe9c5896a08a164cb0dea092377d71387dbcafe109ba054e1f82f1f", "sha256:6ed67cf12fbcf85a326fd5fba2ad8d8bc657eac6b29038a52d5fcf33f2f13903", "sha256:7b61cdf7a7bfcdcee0bce3b7248651d6ff099fe16098ef2c22ef79e0cd09ba4c", "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" ], "RepoTags": [ "aiready-local-api:latest" ], "Reference": "aiready-local-api:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-08-19T13:18:02.024288521Z", "history": [ { "created": "2026-04-16T23:53:02Z", "created_by": "ADD alpine-minirootfs-3.22.4-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-16T23:53:02Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "ARG BUN_RUNTIME_TRANSPILER_CACHE_PATH=0", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "ENV BUN_RUNTIME_TRANSPILER_CACHE_PATH=0", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "ARG BUN_INSTALL_BIN=/usr/local/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "ENV BUN_INSTALL_BIN=/usr/local/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "COPY /usr/local/bin/bun /usr/local/bin/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-13T03:50:41Z", "created_by": "COPY docker-entrypoint.sh /usr/local/bin/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-13T03:50:41Z", "created_by": "RUN |2 BUN_RUNTIME_TRANSPILER_CACHE_PATH=0 BUN_INSTALL_BIN=/usr/local/bin /bin/sh -c mkdir -p /usr/local/bun-node-fallback-bin \u0026\u0026 ln -s /usr/local/bin/bun /usr/local/bun-node-fallback-bin/node # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-13T03:50:41Z", "created_by": "ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "RUN |2 BUN_RUNTIME_TRANSPILER_CACHE_PATH=0 BUN_INSTALL_BIN=/usr/local/bin /bin/sh -c addgroup -g 1000 bun \u0026\u0026 adduser -u 1000 -G bun -s /bin/sh -D bun \u0026\u0026 ln -s /usr/local/bin/bun /usr/local/bin/bunx \u0026\u0026 apk add libgcc libstdc++ \u0026\u0026 which bun \u0026\u0026 which bunx \u0026\u0026 bun --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-13T03:50:41Z", "created_by": "WORKDIR /home/bun/app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-13T03:50:41Z", "created_by": "ENTRYPOINT [\"/usr/local/bin/docker-entrypoint.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-13T03:50:41Z", "created_by": "CMD [\"/usr/local/bin/bun\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-08-19T13:13:01Z", "created_by": "RUN /bin/sh -c apk add --no-cache libc6-compat openssl netcat-openbsd bash nodejs wget # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY package.json bun.lock tsconfig.base.json ./ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY packages/db/package.json ./packages/db/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY packages/shared/package.json ./packages/shared/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY apps/api/package.json ./apps/api/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY apps/web/package.json ./apps/web/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY apps/worker/package.json ./apps/worker/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:13:01Z", "created_by": "COPY apps/mcp/package.json ./apps/mcp/package.json # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:18:02Z", "created_by": "RUN /bin/sh -c bun install --frozen-lockfile # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-08-19T13:18:02Z", "created_by": "EXPOSE [4000/tcp 5173/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0", "sha256:9072d322eb16c6a414861801ae295eb67839e0aeabeab982bea0520b6fccdeaa", "sha256:135be4fad03ab91972ef4eb6846e200938c2dea183881ba5cac3d79648a09737", "sha256:7a415decbb54be30a9369d7466887b96544eedd7b28dbb7ad87dc6381a4b91a0", "sha256:fb0c09554b3fc2d49fda0df4305e80bbd89a17e405ed02b65b79c54fcf6fd637", "sha256:592e878c2cd79244e9ecf582b4688c9fa9c45bb31b1890119e1fb88fae6a6784", "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71", "sha256:6a849c74dbba82e0169375be4b4f8020b6b3256ac5487e48cdbcd186e1040b1d", "sha256:b59fe7acbc9a7552ce6be816fdc697ac976acef593fe044ddd23d0874f874297", "sha256:eceb7e3e19a564b0acca63b6f57fd2c370ebf3eaec466f60515eb5a7f55e8272", "sha256:03bd984a7be57a030f4640c35e4f920a7b2073a936239f4e8df32d88ff82f391", "sha256:b7917fdb6764224cf26d8e35edccd08a40e9d202d740972f6bc5fc629b0a775a", "sha256:276b76411fe9c5896a08a164cb0dea092377d71387dbcafe109ba054e1f82f1f", "sha256:6ed67cf12fbcf85a326fd5fba2ad8d8bc657eac6b29038a52d5fcf33f2f13903", "sha256:7b61cdf7a7bfcdcee0bce3b7248651d6ff099fe16098ef2c22ef79e0cd09ba4c", "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" ] }, "config": { "Cmd": [ "/usr/local/bin/bun" ], "Entrypoint": [ "/usr/local/bin/docker-entrypoint.sh" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin", "BUN_RUNTIME_TRANSPILER_CACHE_PATH=0", "BUN_INSTALL_BIN=/usr/local/bin" ], "Labels": { "com.docker.compose.project": "aiready-local", "com.docker.compose.service": "api", "com.docker.compose.version": "5.2.0", "org.opencontainers.image.created": "2026-05-13T03:50:34.645Z", "org.opencontainers.image.description": "Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one", "org.opencontainers.image.licenses": "NOASSERTION", "org.opencontainers.image.revision": "0d9b296af33f2b851fcbf4df3e9ec89751734ba4", "org.opencontainers.image.source": "https://github.com/oven-sh/bun", "org.opencontainers.image.title": "bun", "org.opencontainers.image.url": "https://github.com/oven-sh/bun", "org.opencontainers.image.version": "1.3.14-alpine" }, "WorkingDir": "/app", "ExposedPorts": { "4000/tcp": {}, "5173/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 8609792, "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, { "Size": 88612352, "DiffID": "sha256:9072d322eb16c6a414861801ae295eb67839e0aeabeab982bea0520b6fccdeaa" }, { "Size": 3584, "DiffID": "sha256:135be4fad03ab91972ef4eb6846e200938c2dea183881ba5cac3d79648a09737" }, { "Size": 3072, "DiffID": "sha256:7a415decbb54be30a9369d7466887b96544eedd7b28dbb7ad87dc6381a4b91a0" }, { "Size": 5588992, "DiffID": "sha256:fb0c09554b3fc2d49fda0df4305e80bbd89a17e405ed02b65b79c54fcf6fd637" }, { "Size": 2560, "DiffID": "sha256:592e878c2cd79244e9ecf582b4688c9fa9c45bb31b1890119e1fb88fae6a6784" }, { "Size": 81760768, "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, { "Size": 1536, "DiffID": "sha256:6a849c74dbba82e0169375be4b4f8020b6b3256ac5487e48cdbcd186e1040b1d" }, { "Size": 233984, "DiffID": "sha256:b59fe7acbc9a7552ce6be816fdc697ac976acef593fe044ddd23d0874f874297" }, { "Size": 4096, "DiffID": "sha256:eceb7e3e19a564b0acca63b6f57fd2c370ebf3eaec466f60515eb5a7f55e8272" }, { "Size": 4096, "DiffID": "sha256:03bd984a7be57a030f4640c35e4f920a7b2073a936239f4e8df32d88ff82f391" }, { "Size": 4608, "DiffID": "sha256:b7917fdb6764224cf26d8e35edccd08a40e9d202d740972f6bc5fc629b0a775a" }, { "Size": 5120, "DiffID": "sha256:276b76411fe9c5896a08a164cb0dea092377d71387dbcafe109ba054e1f82f1f" }, { "Size": 4096, "DiffID": "sha256:6ed67cf12fbcf85a326fd5fba2ad8d8bc657eac6b29038a52d5fcf33f2f13903" }, { "Size": 3584, "DiffID": "sha256:7b61cdf7a7bfcdcee0bce3b7248651d6ff099fe16098ef2c22ef79e0cd09ba4c" }, { "Size": 585431552, "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" } ] }, "Results": [ { "Target": "aiready-local-api (alpine 3.22.4)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "ada-libs@2.9.2-r4", "Name": "ada-libs", "Identifier": { "PURL": "pkg:apk/alpine/ada-libs@2.9.2-r4?arch=x86_64\u0026distro=3.22.4", "UID": "dcc7ca4dd55b7567" }, "Version": "2.9.2-r4", "Arch": "x86_64", "SrcName": "ada", "SrcVersion": "2.9.2-r4", "Licenses": [ "Apache-2.0", "MIT", "MPL-2.0" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "libgcc@14.2.0-r6", "libstdc++@14.2.0-r6", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:63dec04dbb80d868fe8f2d257414a7e9b58ef023", "InstalledFiles": [ "usr/lib/libada.so.2", "usr/lib/libada.so.2.9.2" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout@3.7.0-r0", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.0-r0?arch=x86_64\u0026distro=3.22.4", "UID": "5d7e59cb3cf460c9" }, "Version": "3.7.0-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.0-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.0-r0", "busybox-binsh@1.37.0-r20" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:29f99748eea1ffe01f70b34024dc45c46d211f8d", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.0-r0", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.0-r0?arch=x86_64\u0026distro=3.22.4", "UID": "ab78613e89e34197" }, "Version": "3.7.0-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.0-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:73f5ef65f8333a1784102df973c076d5a7d5b5fe", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.5-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.5-r0?arch=x86_64\u0026distro=3.22.4", "UID": "82fba6933d3c7e01" }, "Version": "2.5-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.5-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:b175e48144ebad03d6ba11d45b25aafc2de310c1", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.22.4-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.22.4-r0?arch=x86_64\u0026distro=3.22.4", "UID": "c18fc07f01c755fc" }, "Version": "3.22.4-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.22.4-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.5-r0" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:1a6b3a65cfc7dab24e4dff7fa7cc6bad099723a5", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@2.14.9-r3", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@2.14.9-r3?arch=x86_64\u0026distro=3.22.4", "UID": "a7f6f1b39b82340e" }, "Version": "2.14.9-r3", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "2.14.9-r3", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libapk2@2.14.9-r3", "libcrypto3@3.5.7-r0", "musl@1.2.5-r12", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:992f5e39b0d45f326c9ed2e9b1fe737809c23ed9", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "bash@5.2.37-r0", "Name": "bash", "Identifier": { "PURL": "pkg:apk/alpine/bash@5.2.37-r0?arch=x86_64\u0026distro=3.22.4", "UID": "991fe795fd6fa5c6" }, "Version": "5.2.37-r0", "Arch": "x86_64", "SrcName": "bash", "SrcVersion": "5.2.37-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r20", "musl@1.2.5-r12", "readline@8.2.13-r1" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:e2e7691628b43701a0fe7228b8d986a7aeb58aa9", "InstalledFiles": [ "bin/bash", "etc/bash/bashrc", "etc/profile.d/00-bashrc.sh", "usr/lib/bash/accept", "usr/lib/bash/basename", "usr/lib/bash/csv", "usr/lib/bash/cut", "usr/lib/bash/dirname", "usr/lib/bash/dsv", "usr/lib/bash/fdflags", "usr/lib/bash/finfo", "usr/lib/bash/getconf", "usr/lib/bash/head", "usr/lib/bash/id", "usr/lib/bash/ln", "usr/lib/bash/logname", "usr/lib/bash/mkdir", "usr/lib/bash/mkfifo", "usr/lib/bash/mktemp", "usr/lib/bash/mypid", "usr/lib/bash/pathchk", "usr/lib/bash/print", "usr/lib/bash/printenv", "usr/lib/bash/push", "usr/lib/bash/realpath", "usr/lib/bash/rm", "usr/lib/bash/rmdir", "usr/lib/bash/seq", "usr/lib/bash/setpgid", "usr/lib/bash/sleep", "usr/lib/bash/stat", "usr/lib/bash/strftime", "usr/lib/bash/sync", "usr/lib/bash/tee", "usr/lib/bash/truefalse", "usr/lib/bash/tty", "usr/lib/bash/uname", "usr/lib/bash/unlink", "usr/lib/bash/whoami" ], "AnalyzedBy": "apk" }, { "ID": "brotli-libs@1.1.0-r2", "Name": "brotli-libs", "Identifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.1.0-r2?arch=x86_64\u0026distro=3.22.4", "UID": "91a3bf58f0c44ca5" }, "Version": "1.1.0-r2", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:889fa02c5f7cdd90283ce2b68959e9c44e5dfbf2", "InstalledFiles": [ "usr/lib/libbrotlicommon.so.1", "usr/lib/libbrotlicommon.so.1.1.0", "usr/lib/libbrotlidec.so.1", "usr/lib/libbrotlidec.so.1.1.0", "usr/lib/libbrotlienc.so.1", "usr/lib/libbrotlienc.so.1.1.0" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r20", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r20?arch=x86_64\u0026distro=3.22.4", "UID": "506f3663699c0126" }, "Version": "1.37.0-r20", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r20", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:3e9d75288280b3c492e91f30e126c2400d1701b3", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r20", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r20?arch=x86_64\u0026distro=3.22.4", "UID": "82cca645a20a4c54" }, "Version": "1.37.0-r20", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r20", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r20" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:acd495b3054831a7a33137aa5a2ba6193a08a2d2", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "c-ares@1.34.8-r0", "Name": "c-ares", "Identifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.8-r0?arch=x86_64\u0026distro=3.22.4", "UID": "280315def2ad581f" }, "Version": "1.34.8-r0", "Arch": "x86_64", "SrcName": "c-ares", "SrcVersion": "1.34.8-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:fc3e4ca8993afeac0a546a45065f2ed30f3c2195", "InstalledFiles": [ "usr/lib/libcares.so.2", "usr/lib/libcares.so.2.19.7" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20260611-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.22.4", "UID": "9e6893c35f042c65" }, "Version": "20260611-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260611-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r20", "libcrypto3@3.5.7-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:f56301064c50957c1f73cdfef4c91dff33588584", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20260413-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260413-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f85b30502cdea1a0" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:dba0212f57f025728b812c0528995e8b9cd2c9b3", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "gcompat@1.1.0-r4", "Name": "gcompat", "Identifier": { "PURL": "pkg:apk/alpine/gcompat@1.1.0-r4?arch=x86_64\u0026distro=3.22.4", "UID": "ca6ae3167b716870" }, "Version": "1.1.0-r4", "Arch": "x86_64", "SrcName": "gcompat", "SrcVersion": "1.1.0-r4", "Licenses": [ "NCSA" ], "Maintainer": "Peter Shkenev \u003csanturysim@gmail.com\u003e", "DependsOn": [ "libucontext@1.3.2-r0", "musl-obstack@1.2.3-r2", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:a98107a09ee41bcb430d1e6a33d8e05aaa8e6b40", "InstalledFiles": [ "lib/ld-linux-x86-64.so.2", "lib/libc.so.6", "lib/libcrypt.so.1", "lib/libgcompat.so.0", "lib/libm.so.6", "lib/libpthread.so.0", "lib/libresolv.so.2", "lib/librt.so.1", "lib/libutil.so.1", "lib64/ld-linux-x86-64.so.2" ], "AnalyzedBy": "apk" }, { "ID": "icu-data-en@76.1-r1", "Name": "icu-data-en", "Identifier": { "PURL": "pkg:apk/alpine/icu-data-en@76.1-r1?arch=x86_64\u0026distro=3.22.4", "UID": "cd898df18705d68f" }, "Version": "76.1-r1", "Arch": "x86_64", "SrcName": "icu", "SrcVersion": "76.1-r1", "Licenses": [ "ICU" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r20" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:972263589cb3ecc623c8286c28a0184baf59a1f4", "InstalledFiles": [ "usr/share/icu/76.1/icudt76l.dat" ], "AnalyzedBy": "apk" }, { "ID": "icu-libs@76.1-r1", "Name": "icu-libs", "Identifier": { "PURL": "pkg:apk/alpine/icu-libs@76.1-r1?arch=x86_64\u0026distro=3.22.4", "UID": "e6c8cef9dbf5db9f" }, "Version": "76.1-r1", "Arch": "x86_64", "SrcName": "icu", "SrcVersion": "76.1-r1", "Licenses": [ "ICU" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "icu-data-en@76.1-r1", "libgcc@14.2.0-r6", "libstdc++@14.2.0-r6", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:66abca0949761b6787620d14d5181e2aeed37687", "InstalledFiles": [ "usr/lib/libicudata.so.76", "usr/lib/libicudata.so.76.1", "usr/lib/libicui18n.so.76", "usr/lib/libicui18n.so.76.1", "usr/lib/libicuio.so.76", "usr/lib/libicuio.so.76.1", "usr/lib/libicuuc.so.76", "usr/lib/libicuuc.so.76.1" ], "AnalyzedBy": "apk" }, { "ID": "libapk2@2.14.9-r3", "Name": "libapk2", "Identifier": { "PURL": "pkg:apk/alpine/libapk2@2.14.9-r3?arch=x86_64\u0026distro=3.22.4", "UID": "3992717c3ad6522a" }, "Version": "2.14.9-r3", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "2.14.9-r3", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libcrypto3@3.5.7-r0", "libssl3@3.5.7-r0", "musl@1.2.5-r12", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:902fd71646d6e087e472c67b0f634c043a2195bc", "InstalledFiles": [ "usr/lib/libapk.so.2.14.9" ], "AnalyzedBy": "apk" }, { "ID": "libbsd@0.12.2-r0", "Name": "libbsd", "Identifier": { "PURL": "pkg:apk/alpine/libbsd@0.12.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "64583b953687f3a4" }, "Version": "0.12.2-r0", "Arch": "x86_64", "SrcName": "libbsd", "SrcVersion": "0.12.2-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libmd@1.1.0-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:8c3724586ce305e5e6552acf4b89004f7fc05dd9", "InstalledFiles": [ "usr/lib/libbsd.so.0", "usr/lib/libbsd.so.0.12.2" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.7-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "e83dc28845628467" }, "Version": "3.5.7-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.7-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:8a18f7dff609b38d87d4d1f35268eb4f877ca0f7", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libgcc@14.2.0-r6", "Name": "libgcc", "Identifier": { "PURL": "pkg:apk/alpine/libgcc@14.2.0-r6?arch=x86_64\u0026distro=3.22.4", "UID": "52cf3ec37cd6ff6b" }, "Version": "14.2.0-r6", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "14.2.0-r6", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:fb0c09554b3fc2d49fda0df4305e80bbd89a17e405ed02b65b79c54fcf6fd637" }, "Digest": "sha1:6945911dc2b13485e97460d9df2716ad1a0aa32d", "InstalledFiles": [ "usr/lib/libgcc_s.so.1" ], "AnalyzedBy": "apk" }, { "ID": "libidn2@2.3.7-r0", "Name": "libidn2", "Identifier": { "PURL": "pkg:apk/alpine/libidn2@2.3.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "fca44bc7401d2211" }, "Version": "2.3.7-r0", "Arch": "x86_64", "SrcName": "libidn2", "SrcVersion": "2.3.7-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libunistring@1.3-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:e2e93b247187a15a2164f4b7e5f4a725a3b5d488", "InstalledFiles": [ "usr/lib/libidn2.so.0", "usr/lib/libidn2.so.0.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libmd@1.1.0-r0", "Name": "libmd", "Identifier": { "PURL": "pkg:apk/alpine/libmd@1.1.0-r0?arch=x86_64\u0026distro=3.22.4", "UID": "1f4bbc6365d43a95" }, "Version": "1.1.0-r0", "Arch": "x86_64", "SrcName": "libmd", "SrcVersion": "1.1.0-r0", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause", "ISC", "Beerware", "Public", "Domain" ], "Maintainer": "omni \u003comni+alpine@hack.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:65a135e641ef9b082f98f70ba100e8617a319042", "InstalledFiles": [ "usr/lib/libmd.so.0", "usr/lib/libmd.so.0.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libncursesw@6.5_p20250503-r0", "Name": "libncursesw", "Identifier": { "PURL": "pkg:apk/alpine/libncursesw@6.5_p20250503-r0?arch=x86_64\u0026distro=3.22.4", "UID": "d557cde6f5a2d358" }, "Version": "6.5_p20250503-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20250503-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12", "ncurses-terminfo-base@6.5_p20250503-r0" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:42901f1528399d67e07e14085ee53f1a369b240a", "InstalledFiles": [ "usr/lib/libncursesw.so.6", "usr/lib/libncursesw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.7-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "4537cda1539525e2" }, "Version": "3.5.7-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.7-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.7-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:25116e961b76dc73815bcba15a64be51b5df606f", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libstdc++@14.2.0-r6", "Name": "libstdc++", "Identifier": { "PURL": "pkg:apk/alpine/libstdc%2B%2B@14.2.0-r6?arch=x86_64\u0026distro=3.22.4", "UID": "550886d080911bc6" }, "Version": "14.2.0-r6", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "14.2.0-r6", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "libgcc@14.2.0-r6", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:fb0c09554b3fc2d49fda0df4305e80bbd89a17e405ed02b65b79c54fcf6fd637" }, "Digest": "sha1:edf5cac1e98ffe4fb3609f48ded83b35bec14c9d", "InstalledFiles": [ "usr/lib/libstdc++.so.6", "usr/lib/libstdc++.so.6.0.33" ], "AnalyzedBy": "apk" }, { "ID": "libucontext@1.3.2-r0", "Name": "libucontext", "Identifier": { "PURL": "pkg:apk/alpine/libucontext@1.3.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "9bed05deaf45077d" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "libucontext", "SrcVersion": "1.3.2-r0", "Licenses": [ "ISC" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:8bb850c112860c9fc1b42003edf75f7494cdf651", "InstalledFiles": [ "usr/lib/libucontext.so.1", "usr/lib/libucontext_posix.so.1" ], "AnalyzedBy": "apk" }, { "ID": "libunistring@1.3-r0", "Name": "libunistring", "Identifier": { "PURL": "pkg:apk/alpine/libunistring@1.3-r0?arch=x86_64\u0026distro=3.22.4", "UID": "bd34ea96b30685c5" }, "Version": "1.3-r0", "Arch": "x86_64", "SrcName": "libunistring", "SrcVersion": "1.3-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:9472d9ab2b634a61ad5edc9b4754fdb1e34bdef9", "InstalledFiles": [ "usr/lib/libunistring.so.5", "usr/lib/libunistring.so.5.2.0" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r12", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r12?arch=x86_64\u0026distro=3.22.4", "UID": "b5a02196ba9bc411" }, "Version": "1.2.5-r12", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r12", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:f3cc854c6dadfeb53136d8d03f04d1ff98769bf9", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-obstack@1.2.3-r2", "Name": "musl-obstack", "Identifier": { "PURL": "pkg:apk/alpine/musl-obstack@1.2.3-r2?arch=x86_64\u0026distro=3.22.4", "UID": "d24b430dd676a56e" }, "Version": "1.2.3-r2", "Arch": "x86_64", "SrcName": "musl-obstack", "SrcVersion": "1.2.3-r2", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:c5c85afa6971eabd4f7a5cea04fc1870cf76f120", "InstalledFiles": [ "usr/lib/libobstack.so.1", "usr/lib/libobstack.so.1.0.0" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r12", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r12?arch=x86_64\u0026distro=3.22.4", "UID": "df612045786a2676" }, "Version": "1.2.5-r12", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r12", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12", "scanelf@1.3.8-r1" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:4f12bfa20780e846579acb151853e8db180ba919", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ncurses-terminfo-base@6.5_p20250503-r0", "Name": "ncurses-terminfo-base", "Identifier": { "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.5_p20250503-r0?arch=x86_64\u0026distro=3.22.4", "UID": "894c1596a3cf9412" }, "Version": "6.5_p20250503-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20250503-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:fea2cc088f02df2feb5da718e70123647f0ef8f7", "InstalledFiles": [ "etc/terminfo/a/alacritty", "etc/terminfo/a/ansi", "etc/terminfo/d/dumb", "etc/terminfo/g/gnome", "etc/terminfo/g/gnome-256color", "etc/terminfo/k/konsole", "etc/terminfo/k/konsole-256color", "etc/terminfo/k/konsole-linux", "etc/terminfo/l/linux", "etc/terminfo/p/putty", "etc/terminfo/p/putty-256color", "etc/terminfo/r/rxvt", "etc/terminfo/r/rxvt-256color", "etc/terminfo/s/screen", "etc/terminfo/s/screen-256color", "etc/terminfo/s/st-0.6", "etc/terminfo/s/st-0.7", "etc/terminfo/s/st-0.8", "etc/terminfo/s/st-0.8.5", "etc/terminfo/s/st-16color", "etc/terminfo/s/st-256color", "etc/terminfo/s/st-direct", "etc/terminfo/s/sun", "etc/terminfo/t/terminator", "etc/terminfo/t/terminology", "etc/terminfo/t/terminology-0.6.1", "etc/terminfo/t/terminology-1.0.0", "etc/terminfo/t/terminology-1.8.1", "etc/terminfo/t/tmux", "etc/terminfo/t/tmux-256color", "etc/terminfo/v/vt100", "etc/terminfo/v/vt102", "etc/terminfo/v/vt200", "etc/terminfo/v/vt220", "etc/terminfo/v/vt52", "etc/terminfo/v/vte", "etc/terminfo/v/vte-256color", "etc/terminfo/x/xterm", "etc/terminfo/x/xterm-256color", "etc/terminfo/x/xterm-color", "etc/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "apk" }, { "ID": "netcat-openbsd@1.229.1-r0", "Name": "netcat-openbsd", "Identifier": { "PURL": "pkg:apk/alpine/netcat-openbsd@1.229.1-r0?arch=x86_64\u0026distro=3.22.4", "UID": "550672dd84805763" }, "Version": "1.229.1-r0", "Arch": "x86_64", "SrcName": "netcat-openbsd", "SrcVersion": "1.229.1-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Leonardo Arena \u003crnalrd@alpinelinux.org\u003e", "DependsOn": [ "libbsd@0.12.2-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:584c6972c8113266e1808fad3a915e734fb2e3e3", "InstalledFiles": [ "usr/bin/nc" ], "AnalyzedBy": "apk" }, { "ID": "nghttp2-libs@1.69.0-r0", "Name": "nghttp2-libs", "Identifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f9f8d33d6cdb5dd6" }, "Version": "1.69.0-r0", "Arch": "x86_64", "SrcName": "nghttp2", "SrcVersion": "1.69.0-r0", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:7f0b8491a71a7d930245a8e063bead5969cdfad9", "InstalledFiles": [ "usr/lib/libnghttp2.so.14", "usr/lib/libnghttp2.so.14.29.4" ], "AnalyzedBy": "apk" }, { "ID": "nodejs@22.23.2-r0", "Name": "nodejs", "Identifier": { "PURL": "pkg:apk/alpine/nodejs@22.23.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f478760ea51ed65f" }, "Version": "22.23.2-r0", "Arch": "x86_64", "SrcName": "nodejs", "SrcVersion": "22.23.2-r0", "Licenses": [ "MIT" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "ada-libs@2.9.2-r4", "brotli-libs@1.1.0-r2", "busybox-binsh@1.37.0-r20", "c-ares@1.34.8-r0", "ca-certificates@20260611-r0", "icu-libs@76.1-r1", "libcrypto3@3.5.7-r0", "libgcc@14.2.0-r6", "libssl3@3.5.7-r0", "libstdc++@14.2.0-r6", "musl@1.2.5-r12", "nghttp2-libs@1.69.0-r0", "simdjson@3.12.0-r0", "simdutf@7.2.1-r0", "sqlite-libs@3.49.2-r1", "zlib@1.3.2-r0", "zstd-libs@1.5.7-r0" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:ed16afea78ded69545a853eef8a5bda092e05d28", "InstalledFiles": [ "usr/bin/node" ], "AnalyzedBy": "apk" }, { "ID": "openssl@3.5.7-r0", "Name": "openssl", "Identifier": { "PURL": "pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "56ad49ba52d53e7c" }, "Version": "3.5.7-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.7-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.7-r0", "libssl3@3.5.7-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:39545d9885bb17e30d7c4127f5fa35ba3e972669", "InstalledFiles": [ "usr/bin/openssl" ], "AnalyzedBy": "apk" }, { "ID": "pcre2@10.46-r0", "Name": "pcre2", "Identifier": { "PURL": "pkg:apk/alpine/pcre2@10.46-r0?arch=x86_64\u0026distro=3.22.4", "UID": "873c50d3886278a1" }, "Version": "10.46-r0", "Arch": "x86_64", "SrcName": "pcre2", "SrcVersion": "10.46-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:8237724bdc50c57c16e64eb0d522d85abc500d10", "InstalledFiles": [ "usr/lib/libpcre2-8.so.0", "usr/lib/libpcre2-8.so.0.14.0", "usr/lib/libpcre2-posix.so.3", "usr/lib/libpcre2-posix.so.3.0.6" ], "AnalyzedBy": "apk" }, { "ID": "readline@8.2.13-r1", "Name": "readline", "Identifier": { "PURL": "pkg:apk/alpine/readline@8.2.13-r1?arch=x86_64\u0026distro=3.22.4", "UID": "2316355c9edc743b" }, "Version": "8.2.13-r1", "Arch": "x86_64", "SrcName": "readline", "SrcVersion": "8.2.13-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "libncursesw@6.5_p20250503-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:d305640121793fd79a7636ed10fcc6cb10155e38", "InstalledFiles": [ "etc/inputrc", "usr/lib/libreadline.so.8", "usr/lib/libreadline.so.8.2" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r1", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r1?arch=x86_64\u0026distro=3.22.4", "UID": "361702d1dd5d8a58" }, "Version": "1.3.8-r1", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:bd6dd1c820d476bcdf8ee38f003bcf2a73323b13", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "simdjson@3.12.0-r0", "Name": "simdjson", "Identifier": { "PURL": "pkg:apk/alpine/simdjson@3.12.0-r0?arch=x86_64\u0026distro=3.22.4", "UID": "ce8baec559676f06" }, "Version": "3.12.0-r0", "Arch": "x86_64", "SrcName": "simdjson", "SrcVersion": "3.12.0-r0", "Licenses": [ "Apache-2.0", "MIT" ], "Maintainer": "Simon Zeni \u003csimon@bl4ckb0ne.ca\u003e", "DependsOn": [ "libgcc@14.2.0-r6", "libstdc++@14.2.0-r6", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:cba46787a363954cf1e1c303de57a3407dd0268d", "InstalledFiles": [ "usr/lib/libsimdjson.so.25", "usr/lib/libsimdjson.so.25.0.0" ], "AnalyzedBy": "apk" }, { "ID": "simdutf@7.2.1-r0", "Name": "simdutf", "Identifier": { "PURL": "pkg:apk/alpine/simdutf@7.2.1-r0?arch=x86_64\u0026distro=3.22.4", "UID": "c79ee8c7ca277bf2" }, "Version": "7.2.1-r0", "Arch": "x86_64", "SrcName": "simdutf", "SrcVersion": "7.2.1-r0", "Licenses": [ "Apache-2.0", "MIT" ], "Maintainer": "lauren n. liberda \u003clauren@selfisekai.rocks\u003e", "DependsOn": [ "libgcc@14.2.0-r6", "libstdc++@14.2.0-r6", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:220f354fcc9be1645190bb9fe0e07c943df850aa", "InstalledFiles": [ "usr/lib/libsimdutf.so.24", "usr/lib/libsimdutf.so.24.0.0" ], "AnalyzedBy": "apk" }, { "ID": "sqlite-libs@3.49.2-r1", "Name": "sqlite-libs", "Identifier": { "PURL": "pkg:apk/alpine/sqlite-libs@3.49.2-r1?arch=x86_64\u0026distro=3.22.4", "UID": "ebc73b85ee4fab87" }, "Version": "3.49.2-r1", "Arch": "x86_64", "SrcName": "sqlite", "SrcVersion": "3.49.2-r1", "Licenses": [ "blessing" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:cb31ad275293ff9e705f41d1c8626e771a589e45", "InstalledFiles": [ "usr/lib/libsqlite3.so.0", "usr/lib/libsqlite3.so.3.49.2" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r20", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r20?arch=x86_64\u0026distro=3.22.4", "UID": "dad74aae12b0a043" }, "Version": "1.37.0-r20", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r20", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.7-r0", "libssl3@3.5.7-r0", "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:8bdfbaab4c99a5d77844ca989971c87161126784", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "wget@1.25.0-r1", "Name": "wget", "Identifier": { "PURL": "pkg:apk/alpine/wget@1.25.0-r1?arch=x86_64\u0026distro=3.22.4", "UID": "f55d4229c72593f8" }, "Version": "1.25.0-r1", "Arch": "x86_64", "SrcName": "wget", "SrcVersion": "1.25.0-r1", "Licenses": [ "GPL-3.0-or-later WITH OpenSSL-Exception" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.7-r0", "libidn2@2.3.7-r0", "libssl3@3.5.7-r0", "musl@1.2.5-r12", "pcre2@10.46-r0", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:5e060ce275227b1fc3281e22c7c0969b7323078d", "InstalledFiles": [ "etc/wgetrc", "usr/bin/wget" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.2-r0", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "16432bdae66ef0ed" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.2-r0", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "Digest": "sha1:4fd2a2fb21261d4b23330157168feb0c5628a4c6", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.2" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.7-r0", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f6d32aedc3e9eb4e" }, "Version": "1.5.7-r0", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.7-r0", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r12" ], "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "Digest": "sha1:50c83112b5619f48d36d69190a4cb7c71f15c7d2", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.7" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.7-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "e83dc28845628467" }, "InstalledVersion": "3.5.7-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:526138605687f30c81795bd3c0d4ae0b75dcb5f37c4fabae3afd3fb11a6e0746", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.7-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "4537cda1539525e2" }, "InstalledVersion": "3.5.7-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f903f20e88b1f29a527b83bd17d1452a2c977c581269a60257e2edc727b99d17", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r12", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r12?arch=x86_64\u0026distro=3.22.4", "UID": "b5a02196ba9bc411" }, "InstalledVersion": "1.2.5-r12", "FixedVersion": "1.2.5-r13", "Status": "fixed", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:2d29c147be208aac68d8803d5bea39600e2ba47d6f31638caf1e59184dccb176", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r12", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r12?arch=x86_64\u0026distro=3.22.4", "UID": "df612045786a2676" }, "InstalledVersion": "1.2.5-r12", "FixedVersion": "1.2.5-r13", "Status": "fixed", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7d6eea86c5461387e9e696585d1ddc5f79f90f50dbc767de7aa8f4c6aa085aee", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-105482", "PkgID": "nodejs@22.23.2-r0", "PkgName": "nodejs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/nodejs@22.23.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f478760ea51ed65f" }, "InstalledVersion": "22.23.2-r0", "FixedVersion": "22.23.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-105482", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f9b0a90b8dd3ca0c594243db0a32a6120e10ec447ed220530a9a1162fe6b946b", "Title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "Description": "A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.", "Severity": "HIGH", "CweIDs": [ "CWE-284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-105482", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://linux.oracle.com/cve/CVE-2026-105482.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nodejs.org/en/blog/release/v22.23.4", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nvd.nist.gov/vuln/detail/CVE-2026-105482", "https://www.cve.org/CVERecord?id=CVE-2026-105482" ], "PublishedDate": "2026-10-23T17:17:19.427Z", "LastModifiedDate": "2026-11-02T16:17:23.48Z" }, { "VulnerabilityID": "CVE-2026-106069", "PkgID": "nodejs@22.23.2-r0", "PkgName": "nodejs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/nodejs@22.23.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "f478760ea51ed65f" }, "InstalledVersion": "22.23.2-r0", "FixedVersion": "22.23.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-106069", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:39c1ae68b75eb45be7807393b31fd7f1e125d7b0c4d7d8f21dc1e1c12a94192e", "Title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "Description": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-106069", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://linux.oracle.com/cve/CVE-2026-106069.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nodejs.org/en/blog/release/v22.23.4", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nvd.nist.gov/vuln/detail/CVE-2026-106069", "https://www.cve.org/CVERecord?id=CVE-2026-106069" ], "PublishedDate": "2026-10-23T17:17:19.74Z", "LastModifiedDate": "2026-11-02T14:17:34.95Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "openssl@3.5.7-r0", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssl@3.5.7-r0?arch=x86_64\u0026distro=3.22.4", "UID": "56ad49ba52d53e7c" }, "InstalledVersion": "3.5.7-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0a71f7caa78023f365b13161b2e9b526e1cad29dee1e178328c11d40ee5a826b", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-103111", "PkgID": "pcre2@10.46-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.46-r0?arch=x86_64\u0026distro=3.22.4", "UID": "873c50d3886278a1" }, "InstalledVersion": "10.46-r0", "FixedVersion": "10.46-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:2300e2e9044f74d95b1a2807a8246888020e2258eedbdd2565fe15a80d27059d", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "pcre2@10.46-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.46-r0?arch=x86_64\u0026distro=3.22.4", "UID": "873c50d3886278a1" }, "InstalledVersion": "10.46-r0", "FixedVersion": "10.46-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3aa80f7f3e788e8d49f05c986acd2a8c404a0f4d8732ca08fd184b7abc8d5a63", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "pcre2@10.46-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.46-r0?arch=x86_64\u0026distro=3.22.4", "UID": "873c50d3886278a1" }, "InstalledVersion": "10.46-r0", "FixedVersion": "10.46-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9879a7278b1a6246fca417be4fd417a0630622c8c5b21734d346b10443ed9a79", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "pcre2@10.46-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.46-r0?arch=x86_64\u0026distro=3.22.4", "UID": "873c50d3886278a1" }, "InstalledVersion": "10.46-r0", "FixedVersion": "10.46-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:7e3825cceb98179781aa8f93f73ba7e90c7cf00d4c02c2f25eeee7d424e66a71" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:124a5a399e8dcabe2aa9251c0882474ae53cf54cb404d74e94f5f6d2c9c285cc", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.2-r0", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.22.4", "UID": "16432bdae66ef0ed" }, "InstalledVersion": "1.3.2-r0", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0854555d70acaa318b38ee50bc667cb51ff6bf0757624624c7ff3b6fe17459a0" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:beb36854fa2a397f8ba0a2dbffb948a3afbb7bd816b655df650b814afb5f6539", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Node.js", "Class": "lang-pkgs", "Type": "node-pkg", "Packages": [ { "ID": "1to2@1.0.0", "Name": "1to2", "Identifier": { "PURL": "pkg:npm/1to2@1.0.0", "UID": "51cad5ca75a5c316" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/nan@2.26.2/node_modules/nan/tools/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@alloc/quick-lru@5.2.0", "Name": "@alloc/quick-lru", "Identifier": { "PURL": "pkg:npm/%40alloc/quick-lru@5.2.0", "UID": "1b62b31664956881" }, "Version": "5.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@alloc+quick-lru@5.2.0/node_modules/@alloc/quick-lru/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/code-frame@7.29.0", "Name": "@babel/code-frame", "Identifier": { "PURL": "pkg:npm/%40babel/code-frame@7.29.0", "UID": "1b91d15bd4e6c29" }, "Version": "7.29.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+code-frame@7.29.0/node_modules/@babel/code-frame/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/compat-data@7.29.0", "Name": "@babel/compat-data", "Identifier": { "PURL": "pkg:npm/%40babel/compat-data@7.29.0", "UID": "86ec4cbc69658b45" }, "Version": "7.29.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+compat-data@7.29.0/node_modules/@babel/compat-data/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/core@7.29.0", "Name": "@babel/core", "Identifier": { "PURL": "pkg:npm/%40babel/core@7.29.0", "UID": "668705453bec5257" }, "Version": "7.29.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+core@7.29.0+b097dd6c05d04ee2/node_modules/@babel/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/generator@7.29.1", "Name": "@babel/generator", "Identifier": { "PURL": "pkg:npm/%40babel/generator@7.29.1", "UID": "fa15ecf33822b58a" }, "Version": "7.29.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+generator@7.29.1/node_modules/@babel/generator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-compilation-targets@7.28.6", "Name": "@babel/helper-compilation-targets", "Identifier": { "PURL": "pkg:npm/%40babel/helper-compilation-targets@7.28.6", "UID": "b4018d8f9b3532f9" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-compilation-targets@7.28.6/node_modules/@babel/helper-compilation-targets/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-globals@7.28.0", "Name": "@babel/helper-globals", "Identifier": { "PURL": "pkg:npm/%40babel/helper-globals@7.28.0", "UID": "521c04dd96c0bc81" }, "Version": "7.28.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-globals@7.28.0/node_modules/@babel/helper-globals/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-module-imports@7.28.6", "Name": "@babel/helper-module-imports", "Identifier": { "PURL": "pkg:npm/%40babel/helper-module-imports@7.28.6", "UID": "3234cac5889d77cd" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-module-imports@7.28.6/node_modules/@babel/helper-module-imports/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-module-transforms@7.28.6", "Name": "@babel/helper-module-transforms", "Identifier": { "PURL": "pkg:npm/%40babel/helper-module-transforms@7.28.6", "UID": "bb7281ca505d619d" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-module-transforms@7.28.6+b097dd6c05d04ee2/node_modules/@babel/helper-module-transforms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-plugin-utils@7.28.6", "Name": "@babel/helper-plugin-utils", "Identifier": { "PURL": "pkg:npm/%40babel/helper-plugin-utils@7.28.6", "UID": "f604f6ad344c3380" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-plugin-utils@7.28.6/node_modules/@babel/helper-plugin-utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-string-parser@7.27.1", "Name": "@babel/helper-string-parser", "Identifier": { "PURL": "pkg:npm/%40babel/helper-string-parser@7.27.1", "UID": "a988b0cf5267778" }, "Version": "7.27.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-string-parser@7.27.1/node_modules/@babel/helper-string-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-validator-identifier@7.28.5", "Name": "@babel/helper-validator-identifier", "Identifier": { "PURL": "pkg:npm/%40babel/helper-validator-identifier@7.28.5", "UID": "7a316101e3f39b80" }, "Version": "7.28.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-validator-identifier@7.28.5/node_modules/@babel/helper-validator-identifier/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helper-validator-option@7.27.1", "Name": "@babel/helper-validator-option", "Identifier": { "PURL": "pkg:npm/%40babel/helper-validator-option@7.27.1", "UID": "4e0aeaa3af6a30" }, "Version": "7.27.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helper-validator-option@7.27.1/node_modules/@babel/helper-validator-option/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/helpers@7.29.2", "Name": "@babel/helpers", "Identifier": { "PURL": "pkg:npm/%40babel/helpers@7.29.2", "UID": "a1f3afc0ec3ca7df" }, "Version": "7.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+helpers@7.29.2/node_modules/@babel/helpers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/parser@7.29.2", "Name": "@babel/parser", "Identifier": { "PURL": "pkg:npm/%40babel/parser@7.29.2", "UID": "d9eebb5ef6171236" }, "Version": "7.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+parser@7.29.2/node_modules/@babel/parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/plugin-syntax-jsx@7.28.6", "Name": "@babel/plugin-syntax-jsx", "Identifier": { "PURL": "pkg:npm/%40babel/plugin-syntax-jsx@7.28.6", "UID": "b530e9e44d1329fd" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+plugin-syntax-jsx@7.28.6+b097dd6c05d04ee2/node_modules/@babel/plugin-syntax-jsx/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/plugin-syntax-typescript@7.28.6", "Name": "@babel/plugin-syntax-typescript", "Identifier": { "PURL": "pkg:npm/%40babel/plugin-syntax-typescript@7.28.6", "UID": "c84edda5b6796bb9" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+plugin-syntax-typescript@7.28.6+b097dd6c05d04ee2/node_modules/@babel/plugin-syntax-typescript/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/plugin-transform-react-jsx-self@7.27.1", "Name": "@babel/plugin-transform-react-jsx-self", "Identifier": { "PURL": "pkg:npm/%40babel/plugin-transform-react-jsx-self@7.27.1", "UID": "e1e833bc4e176cd1" }, "Version": "7.27.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+plugin-transform-react-jsx-self@7.27.1+b097dd6c05d04ee2/node_modules/@babel/plugin-transform-react-jsx-self/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/plugin-transform-react-jsx-source@7.27.1", "Name": "@babel/plugin-transform-react-jsx-source", "Identifier": { "PURL": "pkg:npm/%40babel/plugin-transform-react-jsx-source@7.27.1", "UID": "79dc40adf5dd1040" }, "Version": "7.27.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+plugin-transform-react-jsx-source@7.27.1+b097dd6c05d04ee2/node_modules/@babel/plugin-transform-react-jsx-source/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/template@7.28.6", "Name": "@babel/template", "Identifier": { "PURL": "pkg:npm/%40babel/template@7.28.6", "UID": "1860afcfe10ba577" }, "Version": "7.28.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+template@7.28.6/node_modules/@babel/template/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/traverse@7.29.0", "Name": "@babel/traverse", "Identifier": { "PURL": "pkg:npm/%40babel/traverse@7.29.0", "UID": "d4d03e854c0c2f25" }, "Version": "7.29.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+traverse@7.29.0/node_modules/@babel/traverse/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@babel/types@7.29.0", "Name": "@babel/types", "Identifier": { "PURL": "pkg:npm/%40babel/types@7.29.0", "UID": "624351ea8740db51" }, "Version": "7.29.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@babel+types@7.29.0/node_modules/@babel/types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@balena/dockerignore@1.0.2", "Name": "@balena/dockerignore", "Identifier": { "PURL": "pkg:npm/%40balena/dockerignore@1.0.2", "UID": "9382ee8403ebdfb3" }, "Version": "1.0.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@balena+dockerignore@1.0.2/node_modules/@balena/dockerignore/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/core@1.5.6", "Name": "@better-auth/core", "Identifier": { "PURL": "pkg:npm/%40better-auth/core@1.5.6", "UID": "55a2c2c2214b2238" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+core@1.5.6+629be4143027bd60/node_modules/@better-auth/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/drizzle-adapter@1.5.6", "Name": "@better-auth/drizzle-adapter", "Identifier": { "PURL": "pkg:npm/%40better-auth/drizzle-adapter@1.5.6", "UID": "b754b5390c636fd" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+drizzle-adapter@1.5.6+ffeba6c03195e03b/node_modules/@better-auth/drizzle-adapter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/kysely-adapter@1.5.6", "Name": "@better-auth/kysely-adapter", "Identifier": { "PURL": "pkg:npm/%40better-auth/kysely-adapter@1.5.6", "UID": "2b750d2c602d8549" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+kysely-adapter@1.5.6+3d95870bc646dd28/node_modules/@better-auth/kysely-adapter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/memory-adapter@1.5.6", "Name": "@better-auth/memory-adapter", "Identifier": { "PURL": "pkg:npm/%40better-auth/memory-adapter@1.5.6", "UID": "cf70eb8893cca0da" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+memory-adapter@1.5.6+3d95870bc646dd28/node_modules/@better-auth/memory-adapter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/mongo-adapter@1.5.6", "Name": "@better-auth/mongo-adapter", "Identifier": { "PURL": "pkg:npm/%40better-auth/mongo-adapter@1.5.6", "UID": "b515429603076e5d" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+mongo-adapter@1.5.6+3d95870bc646dd28/node_modules/@better-auth/mongo-adapter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/prisma-adapter@1.5.6", "Name": "@better-auth/prisma-adapter", "Identifier": { "PURL": "pkg:npm/%40better-auth/prisma-adapter@1.5.6", "UID": "4ddc744d91de3218" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+prisma-adapter@1.5.6+3d95870bc646dd28/node_modules/@better-auth/prisma-adapter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/telemetry@1.5.6", "Name": "@better-auth/telemetry", "Identifier": { "PURL": "pkg:npm/%40better-auth/telemetry@1.5.6", "UID": "1631c15289654248" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+telemetry@1.5.6+0572dfe02352794b/node_modules/@better-auth/telemetry/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-auth/utils@0.3.1", "Name": "@better-auth/utils", "Identifier": { "PURL": "pkg:npm/%40better-auth/utils@0.3.1", "UID": "ed3e158cd8b8ea77" }, "Version": "0.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-auth+utils@0.3.1/node_modules/@better-auth/utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@better-fetch/fetch@1.1.21", "Name": "@better-fetch/fetch", "Identifier": { "PURL": "pkg:npm/%40better-fetch/fetch@1.1.21", "UID": "b02f5be147aa06a9" }, "Version": "1.1.21", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@better-fetch+fetch@1.1.21/node_modules/@better-fetch/fetch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@biomejs/biome@1.9.4", "Name": "@biomejs/biome", "Identifier": { "PURL": "pkg:npm/%40biomejs/biome@1.9.4", "UID": "605df8abd36f58f1" }, "Version": "1.9.4", "Licenses": [ "MIT OR Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@biomejs+biome@1.9.4/node_modules/@biomejs/biome/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@biomejs/cli-linux-x64@1.9.4", "Name": "@biomejs/cli-linux-x64", "Identifier": { "PURL": "pkg:npm/%40biomejs/cli-linux-x64@1.9.4", "UID": "239ab5ac98816ce7" }, "Version": "1.9.4", "Licenses": [ "MIT OR Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@biomejs+cli-linux-x64@1.9.4/node_modules/@biomejs/cli-linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@biomejs/cli-linux-x64-musl@1.9.4", "Name": "@biomejs/cli-linux-x64-musl", "Identifier": { "PURL": "pkg:npm/%40biomejs/cli-linux-x64-musl@1.9.4", "UID": "36d54f8b2f92cdb2" }, "Version": "1.9.4", "Licenses": [ "MIT OR Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@biomejs+cli-linux-x64-musl@1.9.4/node_modules/@biomejs/cli-linux-x64-musl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@drizzle-team/brocli@0.10.2", "Name": "@drizzle-team/brocli", "Identifier": { "PURL": "pkg:npm/%40drizzle-team/brocli@0.10.2", "UID": "c362a353c38b9aa4" }, "Version": "0.10.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@drizzle-team+brocli@0.10.2/node_modules/@drizzle-team/brocli/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@esbuild-kit/core-utils@3.3.2", "Name": "@esbuild-kit/core-utils", "Identifier": { "PURL": "pkg:npm/%40esbuild-kit/core-utils@3.3.2", "UID": "ccb1630f33b896d" }, "Version": "3.3.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@esbuild-kit+core-utils@3.3.2/node_modules/@esbuild-kit/core-utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@esbuild-kit/esm-loader@2.6.5", "Name": "@esbuild-kit/esm-loader", "Identifier": { "PURL": "pkg:npm/%40esbuild-kit/esm-loader@2.6.5", "UID": "30c99d8198eb23d1" }, "Version": "2.6.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@esbuild-kit+esm-loader@2.6.5/node_modules/@esbuild-kit/esm-loader/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@esbuild/linux-x64@0.18.20", "Name": "@esbuild/linux-x64", "Identifier": { "PURL": "pkg:npm/%40esbuild/linux-x64@0.18.20", "UID": "a6fa65be2e6830f1" }, "Version": "0.18.20", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@esbuild+linux-x64@0.18.20/node_modules/@esbuild/linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@esbuild/linux-x64@0.25.12", "Name": "@esbuild/linux-x64", "Identifier": { "PURL": "pkg:npm/%40esbuild/linux-x64@0.25.12", "UID": "ed15a64b70de0f0c" }, "Version": "0.25.12", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@esbuild+linux-x64@0.25.12/node_modules/@esbuild/linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@esbuild/linux-x64@0.27.4", "Name": "@esbuild/linux-x64", "Identifier": { "PURL": "pkg:npm/%40esbuild/linux-x64@0.27.4", "UID": "8b87e3250bf80c9d" }, "Version": "0.27.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@esbuild+linux-x64@0.27.4/node_modules/@esbuild/linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@fastify/otel@0.18.0", "Name": "@fastify/otel", "Identifier": { "PURL": "pkg:npm/%40fastify/otel@0.18.0", "UID": "73ae67067b19a882" }, "Version": "0.18.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@fastify+otel@0.18.0+e40b0dfdd726a224/node_modules/@fastify/otel/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@floating-ui/core@1.7.5", "Name": "@floating-ui/core", "Identifier": { "PURL": "pkg:npm/%40floating-ui/core@1.7.5", "UID": "6de3d33532ab7bd7" }, "Version": "1.7.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@floating-ui+core@1.7.5/node_modules/@floating-ui/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@floating-ui/dom@1.7.6", "Name": "@floating-ui/dom", "Identifier": { "PURL": "pkg:npm/%40floating-ui/dom@1.7.6", "UID": "334f122d1ccfd506" }, "Version": "1.7.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@floating-ui+dom@1.7.6/node_modules/@floating-ui/dom/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@floating-ui/react-dom@2.1.8", "Name": "@floating-ui/react-dom", "Identifier": { "PURL": "pkg:npm/%40floating-ui/react-dom@2.1.8", "UID": "e7a34d8de38b2be4" }, "Version": "2.1.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@floating-ui+react-dom@2.1.8+bf16f8eded5e12ee/node_modules/@floating-ui/react-dom/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@floating-ui/utils@0.2.11", "Name": "@floating-ui/utils", "Identifier": { "PURL": "pkg:npm/%40floating-ui/utils@0.2.11", "UID": "2f37671a2930ca2e" }, "Version": "0.2.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@floating-ui+utils@0.2.11/node_modules/@floating-ui/utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grpc/grpc-js@1.14.3", "Name": "@grpc/grpc-js", "Identifier": { "PURL": "pkg:npm/%40grpc/grpc-js@1.14.3", "UID": "db82d8f0b68f64c2" }, "Version": "1.14.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grpc/proto-loader@0.7.15", "Name": "@grpc/proto-loader", "Identifier": { "PURL": "pkg:npm/%40grpc/proto-loader@0.7.15", "UID": "836d51cf5bc39294" }, "Version": "0.7.15", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@grpc+proto-loader@0.7.15/node_modules/@grpc/proto-loader/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grpc/proto-loader@0.8.0", "Name": "@grpc/proto-loader", "Identifier": { "PURL": "pkg:npm/%40grpc/proto-loader@0.8.0", "UID": "3a0d3dfeab83929e" }, "Version": "0.8.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@grpc+proto-loader@0.8.0/node_modules/@grpc/proto-loader/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@hono/node-server@1.19.11", "Name": "@hono/node-server", "Identifier": { "PURL": "pkg:npm/%40hono/node-server@1.19.11", "UID": "e2309435f49238b2" }, "Version": "1.19.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@hono+node-server@1.19.11+2a3da708906d7b8e/node_modules/@hono/node-server/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@hookform/resolvers@5.2.2", "Name": "@hookform/resolvers", "Identifier": { "PURL": "pkg:npm/%40hookform/resolvers@5.2.2", "UID": "9c6b062eff031600" }, "Version": "5.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@hookform+resolvers@5.2.2+b828ecb606cdb5bc/node_modules/@hookform/resolvers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@ioredis/commands@1.5.0", "Name": "@ioredis/commands", "Identifier": { "PURL": "pkg:npm/%40ioredis/commands@1.5.0", "UID": "d2ae6750147a9802" }, "Version": "1.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@ioredis+commands@1.5.0/node_modules/@ioredis/commands/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@ioredis/commands@1.5.1", "Name": "@ioredis/commands", "Identifier": { "PURL": "pkg:npm/%40ioredis/commands@1.5.1", "UID": "adf47c913604182b" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@ioredis+commands@1.5.1/node_modules/@ioredis/commands/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@isaacs/cliui@8.0.2", "Name": "@isaacs/cliui", "Identifier": { "PURL": "pkg:npm/%40isaacs/cliui@8.0.2", "UID": "b58d68be2956c9a5" }, "Version": "8.0.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@isaacs+cliui@8.0.2/node_modules/@isaacs/cliui/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@isaacs/fs-minipass@4.0.1", "Name": "@isaacs/fs-minipass", "Identifier": { "PURL": "pkg:npm/%40isaacs/fs-minipass@4.0.1", "UID": "79692e233586c6be" }, "Version": "4.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/@isaacs/fs-minipass@4.0.1@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@jridgewell/gen-mapping@0.3.13", "Name": "@jridgewell/gen-mapping", "Identifier": { "PURL": "pkg:npm/%40jridgewell/gen-mapping@0.3.13", "UID": "fc3ba5f27d1eb564" }, "Version": "0.3.13", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@jridgewell+gen-mapping@0.3.13/node_modules/@jridgewell/gen-mapping/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@jridgewell/remapping@2.3.5", "Name": "@jridgewell/remapping", "Identifier": { "PURL": "pkg:npm/%40jridgewell/remapping@2.3.5", "UID": "5b1cef3df3d6fdbd" }, "Version": "2.3.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@jridgewell+remapping@2.3.5/node_modules/@jridgewell/remapping/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@jridgewell/resolve-uri@3.1.2", "Name": "@jridgewell/resolve-uri", "Identifier": { "PURL": "pkg:npm/%40jridgewell/resolve-uri@3.1.2", "UID": "1919f33eae33939c" }, "Version": "3.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@jridgewell+resolve-uri@3.1.2/node_modules/@jridgewell/resolve-uri/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@jridgewell/sourcemap-codec@1.5.5", "Name": "@jridgewell/sourcemap-codec", "Identifier": { "PURL": "pkg:npm/%40jridgewell/sourcemap-codec@1.5.5", "UID": "4d32acc1dd1144d5" }, "Version": "1.5.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@jridgewell+sourcemap-codec@1.5.5/node_modules/@jridgewell/sourcemap-codec/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@jridgewell/trace-mapping@0.3.31", "Name": "@jridgewell/trace-mapping", "Identifier": { "PURL": "pkg:npm/%40jridgewell/trace-mapping@0.3.31", "UID": "7bf009172b87ad0a" }, "Version": "0.3.31", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@jridgewell+trace-mapping@0.3.31/node_modules/@jridgewell/trace-mapping/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@js-sdsl/ordered-map@4.4.2", "Name": "@js-sdsl/ordered-map", "Identifier": { "PURL": "pkg:npm/%40js-sdsl/ordered-map@4.4.2", "UID": "370c21d1f511250c" }, "Version": "4.4.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@js-sdsl+ordered-map@4.4.2/node_modules/@js-sdsl/ordered-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@kwsites/file-exists@1.1.1", "Name": "@kwsites/file-exists", "Identifier": { "PURL": "pkg:npm/%40kwsites/file-exists@1.1.1", "UID": "c43330c3fe1e5059" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@kwsites+file-exists@1.1.1/node_modules/@kwsites/file-exists/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@modelcontextprotocol/sdk@1.30.0", "Name": "@modelcontextprotocol/sdk", "Identifier": { "PURL": "pkg:npm/%40modelcontextprotocol/sdk@1.30.0", "UID": "3545723290d6d5f8" }, "Version": "1.30.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@msgpackr-extract/msgpackr-extract-linux-x64@3.0.3", "Name": "@msgpackr-extract/msgpackr-extract-linux-x64", "Identifier": { "PURL": "pkg:npm/%40msgpackr-extract/msgpackr-extract-linux-x64@3.0.3", "UID": "9043457645ad0da3" }, "Version": "3.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@msgpackr-extract+msgpackr-extract-linux-x64@3.0.3/node_modules/@msgpackr-extract/msgpackr-extract-linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@noble/ciphers@2.1.1", "Name": "@noble/ciphers", "Identifier": { "PURL": "pkg:npm/%40noble/ciphers@2.1.1", "UID": "f97dd04b3046d048" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@noble+ciphers@2.1.1/node_modules/@noble/ciphers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@noble/hashes@2.0.1", "Name": "@noble/hashes", "Identifier": { "PURL": "pkg:npm/%40noble/hashes@2.0.1", "UID": "88977b1d8bc249eb" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@noble+hashes@2.0.1/node_modules/@noble/hashes/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/api@1.9.1", "Name": "@opentelemetry/api", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/api@1.9.1", "UID": "3f6dadcc7cc35c6b" }, "Version": "1.9.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+api@1.9.1/node_modules/@opentelemetry/api/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/api-logs@0.207.0", "Name": "@opentelemetry/api-logs", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/api-logs@0.207.0", "UID": "23ddb7e52e348ce3" }, "Version": "0.207.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+api-logs@0.207.0/node_modules/@opentelemetry/api-logs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/api-logs@0.212.0", "Name": "@opentelemetry/api-logs", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/api-logs@0.212.0", "UID": "d20ca80ee2b72141" }, "Version": "0.212.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+api-logs@0.212.0/node_modules/@opentelemetry/api-logs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/api-logs@0.214.0", "Name": "@opentelemetry/api-logs", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/api-logs@0.214.0", "UID": "947dcd6fe5f305ae" }, "Version": "0.214.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+api-logs@0.214.0/node_modules/@opentelemetry/api-logs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/core@2.6.1", "Name": "@opentelemetry/core", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/core@2.6.1", "UID": "ea730bc816de9c37" }, "Version": "2.6.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+core@2.6.1+e40b0dfdd726a224/node_modules/@opentelemetry/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/core@2.7.0", "Name": "@opentelemetry/core", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/core@2.7.0", "UID": "5138f491b54fc7df" }, "Version": "2.7.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+core@2.7.0+e40b0dfdd726a224/node_modules/@opentelemetry/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation@0.207.0", "Name": "@opentelemetry/instrumentation", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation@0.207.0", "UID": "41c2e297ef0ae476" }, "Version": "0.207.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation@0.207.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation@0.212.0", "Name": "@opentelemetry/instrumentation", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation@0.212.0", "UID": "3413e86adadc63fc" }, "Version": "0.212.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation@0.212.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation@0.214.0", "Name": "@opentelemetry/instrumentation", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation@0.214.0", "UID": "3af9ffa3dd7ed46b" }, "Version": "0.214.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation@0.214.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-amqplib@0.61.0", "Name": "@opentelemetry/instrumentation-amqplib", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-amqplib@0.61.0", "UID": "3921ab420601b81" }, "Version": "0.61.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-amqplib@0.61.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-amqplib/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-connect@0.57.0", "Name": "@opentelemetry/instrumentation-connect", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-connect@0.57.0", "UID": "44001759e9f07d6f" }, "Version": "0.57.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-connect@0.57.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-connect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-dataloader@0.31.0", "Name": "@opentelemetry/instrumentation-dataloader", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-dataloader@0.31.0", "UID": "b64f3281de1315c1" }, "Version": "0.31.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-dataloader@0.31.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-dataloader/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-fs@0.33.0", "Name": "@opentelemetry/instrumentation-fs", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-fs@0.33.0", "UID": "23c587cf42703b5a" }, "Version": "0.33.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-fs@0.33.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-fs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-generic-pool@0.57.0", "Name": "@opentelemetry/instrumentation-generic-pool", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-generic-pool@0.57.0", "UID": "c7a5d1df6f815dbd" }, "Version": "0.57.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-generic-pool@0.57.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-generic-pool/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-graphql@0.62.0", "Name": "@opentelemetry/instrumentation-graphql", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-graphql@0.62.0", "UID": "8dcd534a749145bb" }, "Version": "0.62.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-graphql@0.62.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-graphql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-hapi@0.60.0", "Name": "@opentelemetry/instrumentation-hapi", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-hapi@0.60.0", "UID": "4a99b3d53cffea9" }, "Version": "0.60.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-hapi@0.60.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-hapi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-http@0.214.0", "Name": "@opentelemetry/instrumentation-http", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-http@0.214.0", "UID": "125862acd14cb7a2" }, "Version": "0.214.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-http@0.214.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-http/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-ioredis@0.62.0", "Name": "@opentelemetry/instrumentation-ioredis", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-ioredis@0.62.0", "UID": "9cf0205eff47d369" }, "Version": "0.62.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-ioredis@0.62.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-ioredis/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-kafkajs@0.23.0", "Name": "@opentelemetry/instrumentation-kafkajs", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-kafkajs@0.23.0", "UID": "2fefd93ff530f07c" }, "Version": "0.23.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-kafkajs@0.23.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-kafkajs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-knex@0.58.0", "Name": "@opentelemetry/instrumentation-knex", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-knex@0.58.0", "UID": "8c3becb19babe871" }, "Version": "0.58.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-knex@0.58.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-knex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-koa@0.62.0", "Name": "@opentelemetry/instrumentation-koa", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-koa@0.62.0", "UID": "596a1fcd954a5127" }, "Version": "0.62.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-koa@0.62.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-koa/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-lru-memoizer@0.58.0", "Name": "@opentelemetry/instrumentation-lru-memoizer", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-lru-memoizer@0.58.0", "UID": "5252e1a470a0738" }, "Version": "0.58.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-lru-memoizer@0.58.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-lru-memoizer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-mongodb@0.67.0", "Name": "@opentelemetry/instrumentation-mongodb", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-mongodb@0.67.0", "UID": "41b1be4ffa24f90a" }, "Version": "0.67.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-mongodb@0.67.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-mongodb/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-mongoose@0.60.0", "Name": "@opentelemetry/instrumentation-mongoose", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-mongoose@0.60.0", "UID": "c020d557ea90ca23" }, "Version": "0.60.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-mongoose@0.60.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-mongoose/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-mysql@0.60.0", "Name": "@opentelemetry/instrumentation-mysql", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-mysql@0.60.0", "UID": "e5007e64e792a024" }, "Version": "0.60.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-mysql@0.60.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-mysql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-mysql2@0.60.0", "Name": "@opentelemetry/instrumentation-mysql2", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-mysql2@0.60.0", "UID": "8f41b413fc4f194f" }, "Version": "0.60.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-mysql2@0.60.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-mysql2/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-pg@0.66.0", "Name": "@opentelemetry/instrumentation-pg", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-pg@0.66.0", "UID": "8862703901974d10" }, "Version": "0.66.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-pg@0.66.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-pg/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-redis@0.62.0", "Name": "@opentelemetry/instrumentation-redis", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-redis@0.62.0", "UID": "5fa67e8546ec773f" }, "Version": "0.62.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-redis@0.62.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-redis/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-tedious@0.33.0", "Name": "@opentelemetry/instrumentation-tedious", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-tedious@0.33.0", "UID": "cdcd4dcdd9904640" }, "Version": "0.33.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-tedious@0.33.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-tedious/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/instrumentation-undici@0.24.0", "Name": "@opentelemetry/instrumentation-undici", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/instrumentation-undici@0.24.0", "UID": "350b9a2a8a593c8f" }, "Version": "0.24.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+instrumentation-undici@0.24.0+e40b0dfdd726a224/node_modules/@opentelemetry/instrumentation-undici/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/redis-common@0.38.3", "Name": "@opentelemetry/redis-common", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/redis-common@0.38.3", "UID": "a1f33624d71246" }, "Version": "0.38.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+redis-common@0.38.3/node_modules/@opentelemetry/redis-common/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/resources@2.7.0", "Name": "@opentelemetry/resources", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/resources@2.7.0", "UID": "bc5db6b71ae7c157" }, "Version": "2.7.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+resources@2.7.0+e40b0dfdd726a224/node_modules/@opentelemetry/resources/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/sdk-trace-base@2.7.0", "Name": "@opentelemetry/sdk-trace-base", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/sdk-trace-base@2.7.0", "UID": "a8fdc6fa60b92fce" }, "Version": "2.7.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+sdk-trace-base@2.7.0+e40b0dfdd726a224/node_modules/@opentelemetry/sdk-trace-base/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/semantic-conventions@1.40.0", "Name": "@opentelemetry/semantic-conventions", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/semantic-conventions@1.40.0", "UID": "ae8e2320f6f2926f" }, "Version": "1.40.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+semantic-conventions@1.40.0/node_modules/@opentelemetry/semantic-conventions/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@opentelemetry/sql-common@0.41.2", "Name": "@opentelemetry/sql-common", "Identifier": { "PURL": "pkg:npm/%40opentelemetry/sql-common@0.41.2", "UID": "c97d339d4ea85b45" }, "Version": "0.41.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@opentelemetry+sql-common@0.41.2+e40b0dfdd726a224/node_modules/@opentelemetry/sql-common/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@oxc-project/types@0.120.0", "Name": "@oxc-project/types", "Identifier": { "PURL": "pkg:npm/%40oxc-project/types@0.120.0", "UID": "d4d0b5c2a4c6e495" }, "Version": "0.120.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@oxc-project+types@0.120.0/node_modules/@oxc-project/types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@pkgjs/parseargs@0.11.0", "Name": "@pkgjs/parseargs", "Identifier": { "PURL": "pkg:npm/%40pkgjs/parseargs@0.11.0", "UID": "df08799dd3368e1b" }, "Version": "0.11.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@pkgjs+parseargs@0.11.0/node_modules/@pkgjs/parseargs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@playwright/test@1.58.2", "Name": "@playwright/test", "Identifier": { "PURL": "pkg:npm/%40playwright/test@1.58.2", "UID": "ced8fd66b20a129e" }, "Version": "1.58.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@playwright+test@1.58.2/node_modules/@playwright/test/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@prisma/instrumentation@7.6.0", "Name": "@prisma/instrumentation", "Identifier": { "PURL": "pkg:npm/%40prisma/instrumentation@7.6.0", "UID": "b8ecb94abd650996" }, "Version": "7.6.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@prisma+instrumentation@7.6.0+e40b0dfdd726a224/node_modules/@prisma/instrumentation/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/aspromise@1.1.2", "Name": "@protobufjs/aspromise", "Identifier": { "PURL": "pkg:npm/%40protobufjs/aspromise@1.1.2", "UID": "5d0e4b950ae6bee3" }, "Version": "1.1.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+aspromise@1.1.2/node_modules/@protobufjs/aspromise/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/base64@1.1.2", "Name": "@protobufjs/base64", "Identifier": { "PURL": "pkg:npm/%40protobufjs/base64@1.1.2", "UID": "5662b1f2890f86bc" }, "Version": "1.1.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+base64@1.1.2/node_modules/@protobufjs/base64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/codegen@2.0.4", "Name": "@protobufjs/codegen", "Identifier": { "PURL": "pkg:npm/%40protobufjs/codegen@2.0.4", "UID": "51666712210170f" }, "Version": "2.0.4", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+codegen@2.0.4/node_modules/@protobufjs/codegen/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/eventemitter@1.1.0", "Name": "@protobufjs/eventemitter", "Identifier": { "PURL": "pkg:npm/%40protobufjs/eventemitter@1.1.0", "UID": "b672fd35f732e177" }, "Version": "1.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+eventemitter@1.1.0/node_modules/@protobufjs/eventemitter/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/fetch@1.1.0", "Name": "@protobufjs/fetch", "Identifier": { "PURL": "pkg:npm/%40protobufjs/fetch@1.1.0", "UID": "1e23a1baf10ea6cf" }, "Version": "1.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+fetch@1.1.0/node_modules/@protobufjs/fetch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/float@1.0.2", "Name": "@protobufjs/float", "Identifier": { "PURL": "pkg:npm/%40protobufjs/float@1.0.2", "UID": "1c4521947d3c1fb0" }, "Version": "1.0.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+float@1.0.2/node_modules/@protobufjs/float/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/inquire@1.1.0", "Name": "@protobufjs/inquire", "Identifier": { "PURL": "pkg:npm/%40protobufjs/inquire@1.1.0", "UID": "9a689b7d49f4e772" }, "Version": "1.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+inquire@1.1.0/node_modules/@protobufjs/inquire/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/path@1.1.2", "Name": "@protobufjs/path", "Identifier": { "PURL": "pkg:npm/%40protobufjs/path@1.1.2", "UID": "9661cc041aba8ca0" }, "Version": "1.1.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+path@1.1.2/node_modules/@protobufjs/path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/pool@1.1.0", "Name": "@protobufjs/pool", "Identifier": { "PURL": "pkg:npm/%40protobufjs/pool@1.1.0", "UID": "f45210912a69e1cd" }, "Version": "1.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+pool@1.1.0/node_modules/@protobufjs/pool/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@protobufjs/utf8@1.1.0", "Name": "@protobufjs/utf8", "Identifier": { "PURL": "pkg:npm/%40protobufjs/utf8@1.1.0", "UID": "30daf398281ed108" }, "Version": "1.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@protobufjs+utf8@1.1.0/node_modules/@protobufjs/utf8/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/primitive@1.1.3", "Name": "@radix-ui/primitive", "Identifier": { "PURL": "pkg:npm/%40radix-ui/primitive@1.1.3", "UID": "e125992f6d6fbbc8" }, "Version": "1.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+primitive@1.1.3/node_modules/@radix-ui/primitive/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-alert-dialog@1.1.15", "Name": "@radix-ui/react-alert-dialog", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-alert-dialog@1.1.15", "UID": "8af911ed9d17fd74" }, "Version": "1.1.15", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-alert-dialog@1.1.15+243b16c7711ca280/node_modules/@radix-ui/react-alert-dialog/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-arrow@1.1.7", "Name": "@radix-ui/react-arrow", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-arrow@1.1.7", "UID": "3ce7cb05eee55159" }, "Version": "1.1.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-arrow@1.1.7+243b16c7711ca280/node_modules/@radix-ui/react-arrow/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-avatar@1.1.11", "Name": "@radix-ui/react-avatar", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-avatar@1.1.11", "UID": "96b1b97db17af1ac" }, "Version": "1.1.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-avatar@1.1.11+243b16c7711ca280/node_modules/@radix-ui/react-avatar/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-collection@1.1.7", "Name": "@radix-ui/react-collection", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-collection@1.1.7", "UID": "f5f12169c3d380ef" }, "Version": "1.1.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-collection@1.1.7+243b16c7711ca280/node_modules/@radix-ui/react-collection/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-compose-refs@1.1.2", "Name": "@radix-ui/react-compose-refs", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-compose-refs@1.1.2", "UID": "835b9f84ac3d32c8" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-compose-refs@1.1.2+26a211c426f3f87c/node_modules/@radix-ui/react-compose-refs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-context@1.1.2", "Name": "@radix-ui/react-context", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-context@1.1.2", "UID": "37f275f1d97f2e8b" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-context@1.1.2+26a211c426f3f87c/node_modules/@radix-ui/react-context/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-context@1.1.3", "Name": "@radix-ui/react-context", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-context@1.1.3", "UID": "47dde7bde95f396d" }, "Version": "1.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-context@1.1.3+26a211c426f3f87c/node_modules/@radix-ui/react-context/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-dialog@1.1.15", "Name": "@radix-ui/react-dialog", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-dialog@1.1.15", "UID": "e2b396e73ade735d" }, "Version": "1.1.15", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-dialog@1.1.15+243b16c7711ca280/node_modules/@radix-ui/react-dialog/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-direction@1.1.1", "Name": "@radix-ui/react-direction", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-direction@1.1.1", "UID": "eabda58a154fea39" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-direction@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-direction/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-dismissable-layer@1.1.11", "Name": "@radix-ui/react-dismissable-layer", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-dismissable-layer@1.1.11", "UID": "b5c7f07f372a811e" }, "Version": "1.1.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-dismissable-layer@1.1.11+243b16c7711ca280/node_modules/@radix-ui/react-dismissable-layer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-dropdown-menu@2.1.16", "Name": "@radix-ui/react-dropdown-menu", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-dropdown-menu@2.1.16", "UID": "d29906f4ababbd60" }, "Version": "2.1.16", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-dropdown-menu@2.1.16+243b16c7711ca280/node_modules/@radix-ui/react-dropdown-menu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-focus-guards@1.1.3", "Name": "@radix-ui/react-focus-guards", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-focus-guards@1.1.3", "UID": "22378ed8e5ea82a9" }, "Version": "1.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-focus-guards@1.1.3+26a211c426f3f87c/node_modules/@radix-ui/react-focus-guards/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-focus-scope@1.1.7", "Name": "@radix-ui/react-focus-scope", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-focus-scope@1.1.7", "UID": "9218a2e7559c1d75" }, "Version": "1.1.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-focus-scope@1.1.7+243b16c7711ca280/node_modules/@radix-ui/react-focus-scope/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-id@1.1.1", "Name": "@radix-ui/react-id", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-id@1.1.1", "UID": "865e25bbc1e2e9c0" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-id@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-id/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-menu@2.1.16", "Name": "@radix-ui/react-menu", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-menu@2.1.16", "UID": "6d97c7b77e8412f8" }, "Version": "2.1.16", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-menu@2.1.16+243b16c7711ca280/node_modules/@radix-ui/react-menu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-popper@1.2.8", "Name": "@radix-ui/react-popper", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-popper@1.2.8", "UID": "56613c2d7cb82478" }, "Version": "1.2.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-popper@1.2.8+243b16c7711ca280/node_modules/@radix-ui/react-popper/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-portal@1.1.9", "Name": "@radix-ui/react-portal", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-portal@1.1.9", "UID": "ce7ecd7855db637f" }, "Version": "1.1.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-portal@1.1.9+243b16c7711ca280/node_modules/@radix-ui/react-portal/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-presence@1.1.5", "Name": "@radix-ui/react-presence", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-presence@1.1.5", "UID": "2e017f14e6ecb00a" }, "Version": "1.1.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-presence@1.1.5+243b16c7711ca280/node_modules/@radix-ui/react-presence/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-primitive@2.1.3", "Name": "@radix-ui/react-primitive", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-primitive@2.1.3", "UID": "74a39a06f2ff4037" }, "Version": "2.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-primitive@2.1.3+243b16c7711ca280/node_modules/@radix-ui/react-primitive/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-primitive@2.1.4", "Name": "@radix-ui/react-primitive", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-primitive@2.1.4", "UID": "6ad0be1acc75aae2" }, "Version": "2.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-primitive@2.1.4+243b16c7711ca280/node_modules/@radix-ui/react-primitive/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-roving-focus@1.1.11", "Name": "@radix-ui/react-roving-focus", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-roving-focus@1.1.11", "UID": "b8e5ba33c213106" }, "Version": "1.1.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-roving-focus@1.1.11+243b16c7711ca280/node_modules/@radix-ui/react-roving-focus/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-separator@1.1.8", "Name": "@radix-ui/react-separator", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-separator@1.1.8", "UID": "2fb0850c494a6a87" }, "Version": "1.1.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-separator@1.1.8+243b16c7711ca280/node_modules/@radix-ui/react-separator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-slot@1.2.3", "Name": "@radix-ui/react-slot", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-slot@1.2.3", "UID": "14ffd8a9805bca23" }, "Version": "1.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-slot@1.2.3+26a211c426f3f87c/node_modules/@radix-ui/react-slot/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-slot@1.2.4", "Name": "@radix-ui/react-slot", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-slot@1.2.4", "UID": "ebaef323f648b5ca" }, "Version": "1.2.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-slot@1.2.4+26a211c426f3f87c/node_modules/@radix-ui/react-slot/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-tooltip@1.2.8", "Name": "@radix-ui/react-tooltip", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-tooltip@1.2.8", "UID": "5c3218f872427a8b" }, "Version": "1.2.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-tooltip@1.2.8+243b16c7711ca280/node_modules/@radix-ui/react-tooltip/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-callback-ref@1.1.1", "Name": "@radix-ui/react-use-callback-ref", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-callback-ref@1.1.1", "UID": "e73ea9ddb4be9d52" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-callback-ref@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-use-callback-ref/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-controllable-state@1.2.2", "Name": "@radix-ui/react-use-controllable-state", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-controllable-state@1.2.2", "UID": "6af55db341a68f32" }, "Version": "1.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-controllable-state@1.2.2+26a211c426f3f87c/node_modules/@radix-ui/react-use-controllable-state/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-effect-event@0.0.2", "Name": "@radix-ui/react-use-effect-event", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-effect-event@0.0.2", "UID": "4b1782a8ed5bb8a9" }, "Version": "0.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-effect-event@0.0.2+26a211c426f3f87c/node_modules/@radix-ui/react-use-effect-event/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-escape-keydown@1.1.1", "Name": "@radix-ui/react-use-escape-keydown", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-escape-keydown@1.1.1", "UID": "1578b406ee023aca" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-escape-keydown@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-use-escape-keydown/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-is-hydrated@0.1.0", "Name": "@radix-ui/react-use-is-hydrated", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-is-hydrated@0.1.0", "UID": "be69e6894ef2a262" }, "Version": "0.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-is-hydrated@0.1.0+26a211c426f3f87c/node_modules/@radix-ui/react-use-is-hydrated/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-layout-effect@1.1.1", "Name": "@radix-ui/react-use-layout-effect", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-layout-effect@1.1.1", "UID": "a846c71fad02b852" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-layout-effect@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-use-layout-effect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-rect@1.1.1", "Name": "@radix-ui/react-use-rect", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-rect@1.1.1", "UID": "504fb07f91d3e4f1" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-rect@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-use-rect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-use-size@1.1.1", "Name": "@radix-ui/react-use-size", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-use-size@1.1.1", "UID": "51830f3874cbf819" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-use-size@1.1.1+26a211c426f3f87c/node_modules/@radix-ui/react-use-size/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/react-visually-hidden@1.2.3", "Name": "@radix-ui/react-visually-hidden", "Identifier": { "PURL": "pkg:npm/%40radix-ui/react-visually-hidden@1.2.3", "UID": "6590a91824c46447" }, "Version": "1.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+react-visually-hidden@1.2.3+243b16c7711ca280/node_modules/@radix-ui/react-visually-hidden/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@radix-ui/rect@1.1.1", "Name": "@radix-ui/rect", "Identifier": { "PURL": "pkg:npm/%40radix-ui/rect@1.1.1", "UID": "e8e2053f4accaedc" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@radix-ui+rect@1.1.1/node_modules/@radix-ui/rect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@reduxjs/toolkit@2.11.2", "Name": "@reduxjs/toolkit", "Identifier": { "PURL": "pkg:npm/%40reduxjs/toolkit@2.11.2", "UID": "ef356d8cf34a17e3" }, "Version": "2.11.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@reduxjs+toolkit@2.11.2+36c9437e52af45bc/node_modules/@reduxjs/toolkit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@reduxjs/toolkit-query@1.0.0", "Name": "@reduxjs/toolkit-query", "Identifier": { "PURL": "pkg:npm/%40reduxjs/toolkit-query@1.0.0", "UID": "42377e97835dc1c5" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@reduxjs+toolkit@2.11.2+36c9437e52af45bc/node_modules/@reduxjs/toolkit/query/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@reduxjs/toolkit-query-react@1.0.0", "Name": "@reduxjs/toolkit-query-react", "Identifier": { "PURL": "pkg:npm/%40reduxjs/toolkit-query-react@1.0.0", "UID": "cb69c768b33feca4" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@reduxjs+toolkit@2.11.2+36c9437e52af45bc/node_modules/@reduxjs/toolkit/query/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@reduxjs/toolkit-react@1.0.0", "Name": "@reduxjs/toolkit-react", "Identifier": { "PURL": "pkg:npm/%40reduxjs/toolkit-react@1.0.0", "UID": "53f525546b362f38" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@reduxjs+toolkit@2.11.2+36c9437e52af45bc/node_modules/@reduxjs/toolkit/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rolldown/binding-linux-x64-gnu@1.0.0-rc.10", "Name": "@rolldown/binding-linux-x64-gnu", "Identifier": { "PURL": "pkg:npm/%40rolldown/binding-linux-x64-gnu@1.0.0-rc.10", "UID": "881aaa72d98612a6" }, "Version": "1.0.0-rc.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rolldown+binding-linux-x64-gnu@1.0.0-rc.10/node_modules/@rolldown/binding-linux-x64-gnu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rolldown/binding-linux-x64-musl@1.0.0-rc.10", "Name": "@rolldown/binding-linux-x64-musl", "Identifier": { "PURL": "pkg:npm/%40rolldown/binding-linux-x64-musl@1.0.0-rc.10", "UID": "859a01b5fd44ecd3" }, "Version": "1.0.0-rc.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rolldown+binding-linux-x64-musl@1.0.0-rc.10/node_modules/@rolldown/binding-linux-x64-musl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rolldown/pluginutils@1.0.0-rc.10", "Name": "@rolldown/pluginutils", "Identifier": { "PURL": "pkg:npm/%40rolldown/pluginutils@1.0.0-rc.10", "UID": "728458e4977f8557" }, "Version": "1.0.0-rc.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rolldown+pluginutils@1.0.0-rc.10/node_modules/@rolldown/pluginutils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rolldown/pluginutils@1.0.0-rc.3", "Name": "@rolldown/pluginutils", "Identifier": { "PURL": "pkg:npm/%40rolldown/pluginutils@1.0.0-rc.3", "UID": "28bcd51b3fc68731" }, "Version": "1.0.0-rc.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rolldown+pluginutils@1.0.0-rc.3/node_modules/@rolldown/pluginutils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rollup/rollup-linux-x64-gnu@4.60.0", "Name": "@rollup/rollup-linux-x64-gnu", "Identifier": { "PURL": "pkg:npm/%40rollup/rollup-linux-x64-gnu@4.60.0", "UID": "767c41963a1197ef" }, "Version": "4.60.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rollup+rollup-linux-x64-gnu@4.60.0/node_modules/@rollup/rollup-linux-x64-gnu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@rollup/rollup-linux-x64-musl@4.60.0", "Name": "@rollup/rollup-linux-x64-musl", "Identifier": { "PURL": "pkg:npm/%40rollup/rollup-linux-x64-musl@4.60.0", "UID": "b41cd271c5f24940" }, "Version": "4.60.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@rollup+rollup-linux-x64-musl@4.60.0/node_modules/@rollup/rollup-linux-x64-musl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry-internal/browser-utils@10.49.0", "Name": "@sentry-internal/browser-utils", "Identifier": { "PURL": "pkg:npm/%40sentry-internal/browser-utils@10.49.0", "UID": "208b56808906cc6c" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry-internal+browser-utils@10.49.0/node_modules/@sentry-internal/browser-utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry-internal/feedback@10.49.0", "Name": "@sentry-internal/feedback", "Identifier": { "PURL": "pkg:npm/%40sentry-internal/feedback@10.49.0", "UID": "d011d739cf98d682" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry-internal+feedback@10.49.0/node_modules/@sentry-internal/feedback/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry-internal/replay@10.49.0", "Name": "@sentry-internal/replay", "Identifier": { "PURL": "pkg:npm/%40sentry-internal/replay@10.49.0", "UID": "f42e7c851d511eae" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry-internal+replay@10.49.0/node_modules/@sentry-internal/replay/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry-internal/replay-canvas@10.49.0", "Name": "@sentry-internal/replay-canvas", "Identifier": { "PURL": "pkg:npm/%40sentry-internal/replay-canvas@10.49.0", "UID": "9f654b66372a6097" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry-internal+replay-canvas@10.49.0/node_modules/@sentry-internal/replay-canvas/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/browser@10.49.0", "Name": "@sentry/browser", "Identifier": { "PURL": "pkg:npm/%40sentry/browser@10.49.0", "UID": "26ca8b67c142c" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+browser@10.49.0/node_modules/@sentry/browser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/core@10.49.0", "Name": "@sentry/core", "Identifier": { "PURL": "pkg:npm/%40sentry/core@10.49.0", "UID": "121c5d22278af71" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+core@10.49.0/node_modules/@sentry/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/node@10.49.0", "Name": "@sentry/node", "Identifier": { "PURL": "pkg:npm/%40sentry/node@10.49.0", "UID": "81cb9f592e47d573" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+node@10.49.0/node_modules/@sentry/node/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/node-core@10.49.0", "Name": "@sentry/node-core", "Identifier": { "PURL": "pkg:npm/%40sentry/node-core@10.49.0", "UID": "61624cbb346cbb5b" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+node-core@10.49.0+07afda4183cd9459/node_modules/@sentry/node-core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/opentelemetry@10.49.0", "Name": "@sentry/opentelemetry", "Identifier": { "PURL": "pkg:npm/%40sentry/opentelemetry@10.49.0", "UID": "308268f7914f2f6f" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+opentelemetry@10.49.0+a9de41b37105ec63/node_modules/@sentry/opentelemetry/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@sentry/react@10.49.0", "Name": "@sentry/react", "Identifier": { "PURL": "pkg:npm/%40sentry/react@10.49.0", "UID": "c16fb2c852ae0e20" }, "Version": "10.49.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@sentry+react@10.49.0+b1ab299f0a400331/node_modules/@sentry/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@standard-schema/spec@1.1.0", "Name": "@standard-schema/spec", "Identifier": { "PURL": "pkg:npm/%40standard-schema/spec@1.1.0", "UID": "92b8aad54efa4d79" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@standard-schema/utils@0.3.0", "Name": "@standard-schema/utils", "Identifier": { "PURL": "pkg:npm/%40standard-schema/utils@0.3.0", "UID": "7280a6b1a614eeeb" }, "Version": "0.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@standard-schema+utils@0.3.0/node_modules/@standard-schema/utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tailwindcss/node@4.2.2", "Name": "@tailwindcss/node", "Identifier": { "PURL": "pkg:npm/%40tailwindcss/node@4.2.2", "UID": "53cac99f93d50eaf" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tailwindcss+node@4.2.2/node_modules/@tailwindcss/node/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tailwindcss/oxide@4.2.2", "Name": "@tailwindcss/oxide", "Identifier": { "PURL": "pkg:npm/%40tailwindcss/oxide@4.2.2", "UID": "4eceea361562bfec" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tailwindcss+oxide@4.2.2/node_modules/@tailwindcss/oxide/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tailwindcss/oxide-linux-x64-gnu@4.2.2", "Name": "@tailwindcss/oxide-linux-x64-gnu", "Identifier": { "PURL": "pkg:npm/%40tailwindcss/oxide-linux-x64-gnu@4.2.2", "UID": "532b6b27010069ff" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tailwindcss+oxide-linux-x64-gnu@4.2.2/node_modules/@tailwindcss/oxide-linux-x64-gnu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tailwindcss/oxide-linux-x64-musl@4.2.2", "Name": "@tailwindcss/oxide-linux-x64-musl", "Identifier": { "PURL": "pkg:npm/%40tailwindcss/oxide-linux-x64-musl@4.2.2", "UID": "a82ada175d58cb97" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tailwindcss+oxide-linux-x64-musl@4.2.2/node_modules/@tailwindcss/oxide-linux-x64-musl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tailwindcss/postcss@4.2.2", "Name": "@tailwindcss/postcss", "Identifier": { "PURL": "pkg:npm/%40tailwindcss/postcss@4.2.2", "UID": "da0a51e6521bd6c" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tailwindcss+postcss@4.2.2/node_modules/@tailwindcss/postcss/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/history@1.161.6", "Name": "@tanstack/history", "Identifier": { "PURL": "pkg:npm/%40tanstack/history@1.161.6", "UID": "1a87ceb8eff5dad7" }, "Version": "1.161.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+history@1.161.6/node_modules/@tanstack/history/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/query-core@5.95.0", "Name": "@tanstack/query-core", "Identifier": { "PURL": "pkg:npm/%40tanstack/query-core@5.95.0", "UID": "a900e87a9e205e2" }, "Version": "5.95.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+query-core@5.95.0/node_modules/@tanstack/query-core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/react-query@5.95.0", "Name": "@tanstack/react-query", "Identifier": { "PURL": "pkg:npm/%40tanstack/react-query@5.95.0", "UID": "cdda1f9523086e78" }, "Version": "5.95.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+react-query@5.95.0+b1ab299f0a400331/node_modules/@tanstack/react-query/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/react-router@1.168.2", "Name": "@tanstack/react-router", "Identifier": { "PURL": "pkg:npm/%40tanstack/react-router@1.168.2", "UID": "8c46441de48ac52a" }, "Version": "1.168.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+react-router@1.168.2+bf16f8eded5e12ee/node_modules/@tanstack/react-router/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/react-store@0.9.2", "Name": "@tanstack/react-store", "Identifier": { "PURL": "pkg:npm/%40tanstack/react-store@0.9.2", "UID": "64d3755fbdc42ade" }, "Version": "0.9.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+react-store@0.9.2+bf16f8eded5e12ee/node_modules/@tanstack/react-store/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/router-core@1.168.2", "Name": "@tanstack/router-core", "Identifier": { "PURL": "pkg:npm/%40tanstack/router-core@1.168.2", "UID": "db294a280219d7bb" }, "Version": "1.168.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+router-core@1.168.2/node_modules/@tanstack/router-core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/router-generator@1.166.16", "Name": "@tanstack/router-generator", "Identifier": { "PURL": "pkg:npm/%40tanstack/router-generator@1.166.16", "UID": "321b1f431529f58" }, "Version": "1.166.16", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+router-generator@1.166.16/node_modules/@tanstack/router-generator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/router-plugin@1.167.3", "Name": "@tanstack/router-plugin", "Identifier": { "PURL": "pkg:npm/%40tanstack/router-plugin@1.167.3", "UID": "622629190420b8f2" }, "Version": "1.167.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+router-plugin@1.167.3+0491a34c72213711/node_modules/@tanstack/router-plugin/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/router-utils@1.161.6", "Name": "@tanstack/router-utils", "Identifier": { "PURL": "pkg:npm/%40tanstack/router-utils@1.161.6", "UID": "29e5a00c67faa6bd" }, "Version": "1.161.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+router-utils@1.161.6/node_modules/@tanstack/router-utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/store@0.9.2", "Name": "@tanstack/store", "Identifier": { "PURL": "pkg:npm/%40tanstack/store@0.9.2", "UID": "ce02fcb0c12cecb1" }, "Version": "0.9.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+store@0.9.2/node_modules/@tanstack/store/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tanstack/virtual-file-routes@1.161.7", "Name": "@tanstack/virtual-file-routes", "Identifier": { "PURL": "pkg:npm/%40tanstack/virtual-file-routes@1.161.7", "UID": "9c8d7d623022f6b" }, "Version": "1.161.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tanstack+virtual-file-routes@1.161.7/node_modules/@tanstack/virtual-file-routes/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/api@0.1.0", "Name": "@template/api", "Identifier": { "PURL": "pkg:npm/%40template/api@0.1.0", "UID": "2085e4afbbb1bb27" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:b7917fdb6764224cf26d8e35edccd08a40e9d202d740972f6bc5fc629b0a775a" }, "FilePath": "app/apps/api/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/db@0.1.0", "Name": "@template/db", "Identifier": { "PURL": "pkg:npm/%40template/db@0.1.0", "UID": "124f86fe26248df5" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:eceb7e3e19a564b0acca63b6f57fd2c370ebf3eaec466f60515eb5a7f55e8272" }, "FilePath": "app/packages/db/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/mcp@0.1.0", "Name": "@template/mcp", "Identifier": { "PURL": "pkg:npm/%40template/mcp@0.1.0", "UID": "62d9d2a8b55dfdea" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:7b61cdf7a7bfcdcee0bce3b7248651d6ff099fe16098ef2c22ef79e0cd09ba4c" }, "FilePath": "app/apps/mcp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/shared@0.1.0", "Name": "@template/shared", "Identifier": { "PURL": "pkg:npm/%40template/shared@0.1.0", "UID": "6913bdbba0ec5877" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:03bd984a7be57a030f4640c35e4f920a7b2073a936239f4e8df32d88ff82f391" }, "FilePath": "app/packages/shared/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/web@0.1.0", "Name": "@template/web", "Identifier": { "PURL": "pkg:npm/%40template/web@0.1.0", "UID": "e5fe8737a55d7e" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:276b76411fe9c5896a08a164cb0dea092377d71387dbcafe109ba054e1f82f1f" }, "FilePath": "app/apps/web/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@template/worker@0.1.0", "Name": "@template/worker", "Identifier": { "PURL": "pkg:npm/%40template/worker@0.1.0", "UID": "bc02a9140c4f18f2" }, "Version": "0.1.0", "Layer": { "DiffID": "sha256:6ed67cf12fbcf85a326fd5fba2ad8d8bc657eac6b29038a52d5fcf33f2f13903" }, "FilePath": "app/apps/worker/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@testcontainers/postgresql@11.14.0", "Name": "@testcontainers/postgresql", "Identifier": { "PURL": "pkg:npm/%40testcontainers/postgresql@11.14.0", "UID": "9a51d6b6955b3c21" }, "Version": "11.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@testcontainers+postgresql@11.14.0/node_modules/@testcontainers/postgresql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/core@3.29.2", "Name": "@tiptap/core", "Identifier": { "PURL": "pkg:npm/%40tiptap/core@3.29.2", "UID": "91728d672c49da10" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+core@3.29.2+cd99e66c7117853e/node_modules/@tiptap/core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-blockquote@3.29.2", "Name": "@tiptap/extension-blockquote", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-blockquote@3.29.2", "UID": "4b5dbe17ce9990b0" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-blockquote@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-blockquote/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-bold@3.29.2", "Name": "@tiptap/extension-bold", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-bold@3.29.2", "UID": "300594825089c5f0" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-bold@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-bold/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-bubble-menu@3.29.2", "Name": "@tiptap/extension-bubble-menu", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-bubble-menu@3.29.2", "UID": "5a64c01a363bea96" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-bubble-menu@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-bubble-menu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-bullet-list@3.29.2", "Name": "@tiptap/extension-bullet-list", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-bullet-list@3.29.2", "UID": "c7186259f8c52d56" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-bullet-list@3.29.2+adc5d746605e6c00/node_modules/@tiptap/extension-bullet-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-code@3.29.2", "Name": "@tiptap/extension-code", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-code@3.29.2", "UID": "7b8c5da6c6e4ada4" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-code@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-code/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-code-block@3.29.2", "Name": "@tiptap/extension-code-block", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-code-block@3.29.2", "UID": "6557a8375c23cad7" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-code-block@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-code-block/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-document@3.29.2", "Name": "@tiptap/extension-document", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-document@3.29.2", "UID": "e2b6b062ea9fe527" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-document@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-document/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-dropcursor@3.29.2", "Name": "@tiptap/extension-dropcursor", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-dropcursor@3.29.2", "UID": "8fb99788eef5f0ec" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-dropcursor@3.29.2+1bbed4a4122825ea/node_modules/@tiptap/extension-dropcursor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-floating-menu@3.29.2", "Name": "@tiptap/extension-floating-menu", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-floating-menu@3.29.2", "UID": "7e34764c61064c3b" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-floating-menu@3.29.2+e6af53ad6c711933/node_modules/@tiptap/extension-floating-menu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-gapcursor@3.29.2", "Name": "@tiptap/extension-gapcursor", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-gapcursor@3.29.2", "UID": "fcd1d543f13a2c97" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-gapcursor@3.29.2+1bbed4a4122825ea/node_modules/@tiptap/extension-gapcursor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-hard-break@3.29.2", "Name": "@tiptap/extension-hard-break", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-hard-break@3.29.2", "UID": "b403ca6487e45be3" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-hard-break@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-hard-break/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-heading@3.29.2", "Name": "@tiptap/extension-heading", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-heading@3.29.2", "UID": "c373318330c8d879" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-heading@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-heading/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-horizontal-rule@3.29.2", "Name": "@tiptap/extension-horizontal-rule", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-horizontal-rule@3.29.2", "UID": "42e1fed72b21251f" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-horizontal-rule@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-horizontal-rule/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-italic@3.29.2", "Name": "@tiptap/extension-italic", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-italic@3.29.2", "UID": "6c2c3dc8e67c3284" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-italic@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-italic/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-link@3.29.2", "Name": "@tiptap/extension-link", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-link@3.29.2", "UID": "923d2d3060504728" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-link@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-link/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-list@3.29.2", "Name": "@tiptap/extension-list", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-list@3.29.2", "UID": "1ca9cdcd79fe2f37" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-list@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-list-item@3.29.2", "Name": "@tiptap/extension-list-item", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-list-item@3.29.2", "UID": "1f94ec9791f1993f" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-list-item@3.29.2+adc5d746605e6c00/node_modules/@tiptap/extension-list-item/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-list-keymap@3.29.2", "Name": "@tiptap/extension-list-keymap", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-list-keymap@3.29.2", "UID": "bf166e9afce65016" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-list-keymap@3.29.2+adc5d746605e6c00/node_modules/@tiptap/extension-list-keymap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-ordered-list@3.29.2", "Name": "@tiptap/extension-ordered-list", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-ordered-list@3.29.2", "UID": "6d261aba21ab091e" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-ordered-list@3.29.2+adc5d746605e6c00/node_modules/@tiptap/extension-ordered-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-paragraph@3.29.2", "Name": "@tiptap/extension-paragraph", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-paragraph@3.29.2", "UID": "ebe9c44d6fc4ac8" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-paragraph@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-paragraph/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-strike@3.29.2", "Name": "@tiptap/extension-strike", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-strike@3.29.2", "UID": "91e7dec1cfa66674" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-strike@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-strike/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-text@3.29.2", "Name": "@tiptap/extension-text", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-text@3.29.2", "UID": "a73352fa702cf2d0" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-text@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-text/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-underline@3.29.2", "Name": "@tiptap/extension-underline", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-underline@3.29.2", "UID": "5870d09417cf1dc5" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-underline@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-underline/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extension-youtube@3.29.2", "Name": "@tiptap/extension-youtube", "Identifier": { "PURL": "pkg:npm/%40tiptap/extension-youtube@3.29.2", "UID": "776b57b80a1a0503" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extension-youtube@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extension-youtube/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/extensions@3.29.2", "Name": "@tiptap/extensions", "Identifier": { "PURL": "pkg:npm/%40tiptap/extensions@3.29.2", "UID": "42ef5f680fcccfd8" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+extensions@3.29.2+f79baf22dcfc54cf/node_modules/@tiptap/extensions/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/pm@3.29.2", "Name": "@tiptap/pm", "Identifier": { "PURL": "pkg:npm/%40tiptap/pm@3.29.2", "UID": "14f09ec1ff7e22ff" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+pm@3.29.2/node_modules/@tiptap/pm/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/react@3.29.2", "Name": "@tiptap/react", "Identifier": { "PURL": "pkg:npm/%40tiptap/react@3.29.2", "UID": "7755995cf84370ab" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+react@3.29.2+966d59ede1ccb21e/node_modules/@tiptap/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@tiptap/starter-kit@3.29.2", "Name": "@tiptap/starter-kit", "Identifier": { "PURL": "pkg:npm/%40tiptap/starter-kit@3.29.2", "UID": "8d0bc2d5645be31d" }, "Version": "3.29.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@tiptap+starter-kit@3.29.2/node_modules/@tiptap/starter-kit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@trpc/client@11.14.1", "Name": "@trpc/client", "Identifier": { "PURL": "pkg:npm/%40trpc/client@11.14.1", "UID": "7a15a7812ad86915" }, "Version": "11.14.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@trpc+client@11.14.1+81bc2c70d3ac8f01/node_modules/@trpc/client/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@trpc/react-query@11.14.1", "Name": "@trpc/react-query", "Identifier": { "PURL": "pkg:npm/%40trpc/react-query@11.14.1", "UID": "929eb5bd92ef5614" }, "Version": "11.14.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@trpc+react-query@11.14.1+eae45408259b31c6/node_modules/@trpc/react-query/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@trpc/server@11.14.1", "Name": "@trpc/server", "Identifier": { "PURL": "pkg:npm/%40trpc/server@11.14.1", "UID": "c61e685a28dedc1b" }, "Version": "11.14.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@trpc+server@11.14.1+1fb4c65d43e298b9/node_modules/@trpc/server/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/babel__core@7.20.5", "Name": "@types/babel__core", "Identifier": { "PURL": "pkg:npm/%40types/babel__core@7.20.5", "UID": "507fc865e6bdc1da" }, "Version": "7.20.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+babel__core@7.20.5/node_modules/@types/babel__core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/babel__generator@7.27.0", "Name": "@types/babel__generator", "Identifier": { "PURL": "pkg:npm/%40types/babel__generator@7.27.0", "UID": "ef41998e924e96a" }, "Version": "7.27.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+babel__generator@7.27.0/node_modules/@types/babel__generator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/babel__template@7.4.4", "Name": "@types/babel__template", "Identifier": { "PURL": "pkg:npm/%40types/babel__template@7.4.4", "UID": "567e822767c1a183" }, "Version": "7.4.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+babel__template@7.4.4/node_modules/@types/babel__template/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/babel__traverse@7.28.0", "Name": "@types/babel__traverse", "Identifier": { "PURL": "pkg:npm/%40types/babel__traverse@7.28.0", "UID": "14be4256dbcf8bc6" }, "Version": "7.28.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+babel__traverse@7.28.0/node_modules/@types/babel__traverse/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/chai@5.2.3", "Name": "@types/chai", "Identifier": { "PURL": "pkg:npm/%40types/chai@5.2.3", "UID": "ed1541aac80a866c" }, "Version": "5.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+chai@5.2.3/node_modules/@types/chai/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/connect@3.4.38", "Name": "@types/connect", "Identifier": { "PURL": "pkg:npm/%40types/connect@3.4.38", "UID": "99470b1e86f5e6e0" }, "Version": "3.4.38", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+connect@3.4.38/node_modules/@types/connect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-array@3.2.2", "Name": "@types/d3-array", "Identifier": { "PURL": "pkg:npm/%40types/d3-array@3.2.2", "UID": "b30b016a35c7ac11" }, "Version": "3.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-array@3.2.2/node_modules/@types/d3-array/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-color@3.1.3", "Name": "@types/d3-color", "Identifier": { "PURL": "pkg:npm/%40types/d3-color@3.1.3", "UID": "2cdce6c15f273e98" }, "Version": "3.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-color@3.1.3/node_modules/@types/d3-color/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-ease@3.0.2", "Name": "@types/d3-ease", "Identifier": { "PURL": "pkg:npm/%40types/d3-ease@3.0.2", "UID": "27d3b0589e849830" }, "Version": "3.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-ease@3.0.2/node_modules/@types/d3-ease/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-interpolate@3.0.4", "Name": "@types/d3-interpolate", "Identifier": { "PURL": "pkg:npm/%40types/d3-interpolate@3.0.4", "UID": "20caadb91ac533e0" }, "Version": "3.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-interpolate@3.0.4/node_modules/@types/d3-interpolate/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-path@3.1.1", "Name": "@types/d3-path", "Identifier": { "PURL": "pkg:npm/%40types/d3-path@3.1.1", "UID": "917cbb9872fdea7b" }, "Version": "3.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-path@3.1.1/node_modules/@types/d3-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-scale@4.0.9", "Name": "@types/d3-scale", "Identifier": { "PURL": "pkg:npm/%40types/d3-scale@4.0.9", "UID": "49c731f4127ae716" }, "Version": "4.0.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-scale@4.0.9/node_modules/@types/d3-scale/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-shape@3.1.8", "Name": "@types/d3-shape", "Identifier": { "PURL": "pkg:npm/%40types/d3-shape@3.1.8", "UID": "3f44c1d1bc46d7f2" }, "Version": "3.1.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-shape@3.1.8/node_modules/@types/d3-shape/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-time@3.0.4", "Name": "@types/d3-time", "Identifier": { "PURL": "pkg:npm/%40types/d3-time@3.0.4", "UID": "6a5d0e51c8f25fe8" }, "Version": "3.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-time@3.0.4/node_modules/@types/d3-time/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/d3-timer@3.0.2", "Name": "@types/d3-timer", "Identifier": { "PURL": "pkg:npm/%40types/d3-timer@3.0.2", "UID": "5dec0f1e63d13de" }, "Version": "3.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+d3-timer@3.0.2/node_modules/@types/d3-timer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/deep-eql@4.0.2", "Name": "@types/deep-eql", "Identifier": { "PURL": "pkg:npm/%40types/deep-eql@4.0.2", "UID": "707a430111e84f0b" }, "Version": "4.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+deep-eql@4.0.2/node_modules/@types/deep-eql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/docker-modem@3.0.6", "Name": "@types/docker-modem", "Identifier": { "PURL": "pkg:npm/%40types/docker-modem@3.0.6", "UID": "85251d6c8ae728ea" }, "Version": "3.0.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+docker-modem@3.0.6/node_modules/@types/docker-modem/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/dockerode@4.0.1", "Name": "@types/dockerode", "Identifier": { "PURL": "pkg:npm/%40types/dockerode@4.0.1", "UID": "41ef1613e2dc5829" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+dockerode@4.0.1/node_modules/@types/dockerode/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/estree@1.0.8", "Name": "@types/estree", "Identifier": { "PURL": "pkg:npm/%40types/estree@1.0.8", "UID": "8e88350b28a22445" }, "Version": "1.0.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+estree@1.0.8/node_modules/@types/estree/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/mysql@2.15.27", "Name": "@types/mysql", "Identifier": { "PURL": "pkg:npm/%40types/mysql@2.15.27", "UID": "f16e30aab933185a" }, "Version": "2.15.27", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+mysql@2.15.27/node_modules/@types/mysql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/node@22.19.15", "Name": "@types/node", "Identifier": { "PURL": "pkg:npm/%40types/node@22.19.15", "UID": "f8caf1651f5e9118" }, "Version": "22.19.15", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+node@22.19.15/node_modules/@types/node/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/nodemailer@6.4.23", "Name": "@types/nodemailer", "Identifier": { "PURL": "pkg:npm/%40types/nodemailer@6.4.23", "UID": "5ad627e48dd2a8b8" }, "Version": "6.4.23", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+nodemailer@6.4.23/node_modules/@types/nodemailer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/pg@8.15.6", "Name": "@types/pg", "Identifier": { "PURL": "pkg:npm/%40types/pg@8.15.6", "UID": "174ad13732c7930d" }, "Version": "8.15.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+pg@8.15.6/node_modules/@types/pg/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/pg@8.20.0", "Name": "@types/pg", "Identifier": { "PURL": "pkg:npm/%40types/pg@8.20.0", "UID": "565f55796aa3a6e8" }, "Version": "8.20.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+pg@8.20.0/node_modules/@types/pg/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/pg-pool@2.0.7", "Name": "@types/pg-pool", "Identifier": { "PURL": "pkg:npm/%40types/pg-pool@2.0.7", "UID": "df842e957b4d595f" }, "Version": "2.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+pg-pool@2.0.7/node_modules/@types/pg-pool/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/qrcode@1.5.6", "Name": "@types/qrcode", "Identifier": { "PURL": "pkg:npm/%40types/qrcode@1.5.6", "UID": "396e92ff77279be9" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+qrcode@1.5.6/node_modules/@types/qrcode/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/react@19.2.14", "Name": "@types/react", "Identifier": { "PURL": "pkg:npm/%40types/react@19.2.14", "UID": "a3948fcf4124b0fb" }, "Version": "19.2.14", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+react@19.2.14/node_modules/@types/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/react-dom@19.2.3", "Name": "@types/react-dom", "Identifier": { "PURL": "pkg:npm/%40types/react-dom@19.2.3", "UID": "f27e031ee7e65aa7" }, "Version": "19.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+react-dom@19.2.3+273cdfb19a04c3e9/node_modules/@types/react-dom/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/ssh2@0.5.52", "Name": "@types/ssh2", "Identifier": { "PURL": "pkg:npm/%40types/ssh2@0.5.52", "UID": "cd4d85e2156a14cc" }, "Version": "0.5.52", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+ssh2@0.5.52/node_modules/@types/ssh2/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/ssh2-streams@0.1.13", "Name": "@types/ssh2-streams", "Identifier": { "PURL": "pkg:npm/%40types/ssh2-streams@0.1.13", "UID": "824dc306d320a3e5" }, "Version": "0.1.13", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+ssh2-streams@0.1.13/node_modules/@types/ssh2-streams/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/tedious@4.0.14", "Name": "@types/tedious", "Identifier": { "PURL": "pkg:npm/%40types/tedious@4.0.14", "UID": "28266fd34c2e130c" }, "Version": "4.0.14", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+tedious@4.0.14/node_modules/@types/tedious/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/trusted-types@2.0.7", "Name": "@types/trusted-types", "Identifier": { "PURL": "pkg:npm/%40types/trusted-types@2.0.7", "UID": "9832aa5a490e8dc4" }, "Version": "2.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+trusted-types@2.0.7/node_modules/@types/trusted-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@types/use-sync-external-store@0.0.6", "Name": "@types/use-sync-external-store", "Identifier": { "PURL": "pkg:npm/%40types/use-sync-external-store@0.0.6", "UID": "c89a93d74d181e55" }, "Version": "0.0.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@types+use-sync-external-store@0.0.6/node_modules/@types/use-sync-external-store/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitejs/plugin-react@5.2.0", "Name": "@vitejs/plugin-react", "Identifier": { "PURL": "pkg:npm/%40vitejs/plugin-react@5.2.0", "UID": "cc42871bb00dd199" }, "Version": "5.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitejs+plugin-react@5.2.0+d3dfdf2e51e2f200/node_modules/@vitejs/plugin-react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/expect@4.1.4", "Name": "@vitest/expect", "Identifier": { "PURL": "pkg:npm/%40vitest/expect@4.1.4", "UID": "64740420b8881bdb" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+expect@4.1.4/node_modules/@vitest/expect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/mocker@4.1.4", "Name": "@vitest/mocker", "Identifier": { "PURL": "pkg:npm/%40vitest/mocker@4.1.4", "UID": "96bb04874f9e9be0" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+mocker@4.1.4+ff78769029146b9c/node_modules/@vitest/mocker/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/pretty-format@4.1.4", "Name": "@vitest/pretty-format", "Identifier": { "PURL": "pkg:npm/%40vitest/pretty-format@4.1.4", "UID": "e9deb4c737b98f39" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+pretty-format@4.1.4/node_modules/@vitest/pretty-format/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/runner@4.1.4", "Name": "@vitest/runner", "Identifier": { "PURL": "pkg:npm/%40vitest/runner@4.1.4", "UID": "2506ea69cae8ea" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+runner@4.1.4/node_modules/@vitest/runner/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/snapshot@4.1.4", "Name": "@vitest/snapshot", "Identifier": { "PURL": "pkg:npm/%40vitest/snapshot@4.1.4", "UID": "198069d35bf0111a" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+snapshot@4.1.4/node_modules/@vitest/snapshot/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/spy@4.1.4", "Name": "@vitest/spy", "Identifier": { "PURL": "pkg:npm/%40vitest/spy@4.1.4", "UID": "9acc0508ee9f6e85" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+spy@4.1.4/node_modules/@vitest/spy/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@vitest/utils@4.1.4", "Name": "@vitest/utils", "Identifier": { "PURL": "pkg:npm/%40vitest/utils@4.1.4", "UID": "a96633e069832123" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/@vitest+utils@4.1.4/node_modules/@vitest/utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "abbrev@5.0.0", "Name": "abbrev", "Identifier": { "PURL": "pkg:npm/abbrev@5.0.0", "UID": "1bc843ff6c0dfae1" }, "Version": "5.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/abbrev@5.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "abort-controller@3.0.0", "Name": "abort-controller", "Identifier": { "PURL": "pkg:npm/abort-controller@3.0.0", "UID": "b2a719cb7c85c5be" }, "Version": "3.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/abort-controller@3.0.0/node_modules/abort-controller/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "accepts@2.0.0", "Name": "accepts", "Identifier": { "PURL": "pkg:npm/accepts@2.0.0", "UID": "4fc42b8fea85e482" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/accepts@2.0.0/node_modules/accepts/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "acorn@8.16.0", "Name": "acorn", "Identifier": { "PURL": "pkg:npm/acorn@8.16.0", "UID": "46a376f3ac0a27ff" }, "Version": "8.16.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/acorn@8.16.0/node_modules/acorn/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "acorn-import-attributes@1.9.5", "Name": "acorn-import-attributes", "Identifier": { "PURL": "pkg:npm/acorn-import-attributes@1.9.5", "UID": "625f6f66245fe63f" }, "Version": "1.9.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/acorn-import-attributes@1.9.5+ed870fa5b9aaeac5/node_modules/acorn-import-attributes/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ajv@8.20.0", "Name": "ajv", "Identifier": { "PURL": "pkg:npm/ajv@8.20.0", "UID": "fe64b711e6ee4443" }, "Version": "8.20.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ajv@8.20.0/node_modules/ajv/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ajv-formats@3.0.1", "Name": "ajv-formats", "Identifier": { "PURL": "pkg:npm/ajv-formats@3.0.1", "UID": "da349d82ecd309ef" }, "Version": "3.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ajv-formats@3.0.1/node_modules/ajv-formats/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ansi-regex@5.0.1", "Name": "ansi-regex", "Identifier": { "PURL": "pkg:npm/ansi-regex@5.0.1", "UID": "4cabc05878f2ab76" }, "Version": "5.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ansi-regex@5.0.1/node_modules/ansi-regex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ansi-regex@6.2.2", "Name": "ansi-regex", "Identifier": { "PURL": "pkg:npm/ansi-regex@6.2.2", "UID": "50838de605d809ae" }, "Version": "6.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ansi-regex@6.2.2/node_modules/ansi-regex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ansi-styles@4.3.0", "Name": "ansi-styles", "Identifier": { "PURL": "pkg:npm/ansi-styles@4.3.0", "UID": "275263e0866abf50" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ansi-styles@4.3.0/node_modules/ansi-styles/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ansi-styles@6.2.3", "Name": "ansi-styles", "Identifier": { "PURL": "pkg:npm/ansi-styles@6.2.3", "UID": "6a201431c3ec440" }, "Version": "6.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ansi-styles@6.2.3/node_modules/ansi-styles/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ansis@4.2.0", "Name": "ansis", "Identifier": { "PURL": "pkg:npm/ansis@4.2.0", "UID": "326829f89c685730" }, "Version": "4.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ansis@4.2.0/node_modules/ansis/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "anymatch@3.1.3", "Name": "anymatch", "Identifier": { "PURL": "pkg:npm/anymatch@3.1.3", "UID": "ae01aed3825dcd50" }, "Version": "3.1.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/anymatch@3.1.3/node_modules/anymatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "archiver@7.0.1", "Name": "archiver", "Identifier": { "PURL": "pkg:npm/archiver@7.0.1", "UID": "9c6781a2e7ce899f" }, "Version": "7.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/archiver@7.0.1/node_modules/archiver/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "archiver-utils@5.0.2", "Name": "archiver-utils", "Identifier": { "PURL": "pkg:npm/archiver-utils@5.0.2", "UID": "84e7cc299f2d10eb" }, "Version": "5.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/archiver-utils@5.0.2/node_modules/archiver-utils/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "aria-hidden@1.2.6", "Name": "aria-hidden", "Identifier": { "PURL": "pkg:npm/aria-hidden@1.2.6", "UID": "536ec50e861c8c0f" }, "Version": "1.2.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/aria-hidden@1.2.6/node_modules/aria-hidden/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "asn1@0.2.6", "Name": "asn1", "Identifier": { "PURL": "pkg:npm/asn1@0.2.6", "UID": "3d8a0cac10f9298c" }, "Version": "0.2.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/asn1@0.2.6/node_modules/asn1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "assertion-error@2.0.1", "Name": "assertion-error", "Identifier": { "PURL": "pkg:npm/assertion-error@2.0.1", "UID": "43ab6d6803b180f2" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/assertion-error@2.0.1/node_modules/assertion-error/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ast-types@0.16.1", "Name": "ast-types", "Identifier": { "PURL": "pkg:npm/ast-types@0.16.1", "UID": "1362c3febcb9dd31" }, "Version": "0.16.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ast-types@0.16.1/node_modules/ast-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "async@3.2.6", "Name": "async", "Identifier": { "PURL": "pkg:npm/async@3.2.6", "UID": "f68b1bb7fac4b5e3" }, "Version": "3.2.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/async@3.2.6/node_modules/async/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "async-lock@1.4.1", "Name": "async-lock", "Identifier": { "PURL": "pkg:npm/async-lock@1.4.1", "UID": "ca1b1206aef863d9" }, "Version": "1.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/async-lock@1.4.1/node_modules/async-lock/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "b4a@1.8.0", "Name": "b4a", "Identifier": { "PURL": "pkg:npm/b4a@1.8.0", "UID": "517ebb8e17316379" }, "Version": "1.8.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/b4a@1.8.0/node_modules/b4a/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "babel-dead-code-elimination@1.0.12", "Name": "babel-dead-code-elimination", "Identifier": { "PURL": "pkg:npm/babel-dead-code-elimination@1.0.12", "UID": "c33efdd3b79bc677" }, "Version": "1.0.12", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/babel-dead-code-elimination@1.0.12/node_modules/babel-dead-code-elimination/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "balanced-match@1.0.2", "Name": "balanced-match", "Identifier": { "PURL": "pkg:npm/balanced-match@1.0.2", "UID": "778547231ba007d" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/balanced-match@1.0.2/node_modules/balanced-match/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "balanced-match@4.0.4", "Name": "balanced-match", "Identifier": { "PURL": "pkg:npm/balanced-match@4.0.4", "UID": "bda67c582b50fa20" }, "Version": "4.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/balanced-match@4.0.4/node_modules/balanced-match/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-events@2.8.2", "Name": "bare-events", "Identifier": { "PURL": "pkg:npm/bare-events@2.8.2", "UID": "d1c835e1eea26c32" }, "Version": "2.8.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-events@2.8.2/node_modules/bare-events/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-fs@4.7.1", "Name": "bare-fs", "Identifier": { "PURL": "pkg:npm/bare-fs@4.7.1", "UID": "43ad0370bf061464" }, "Version": "4.7.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-fs@4.7.1/node_modules/bare-fs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-os@3.8.7", "Name": "bare-os", "Identifier": { "PURL": "pkg:npm/bare-os@3.8.7", "UID": "56f6106dad369f74" }, "Version": "3.8.7", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-os@3.8.7/node_modules/bare-os/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-path@3.0.0", "Name": "bare-path", "Identifier": { "PURL": "pkg:npm/bare-path@3.0.0", "UID": "e693c8f99555a3ba" }, "Version": "3.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-path@3.0.0/node_modules/bare-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-stream@2.13.0", "Name": "bare-stream", "Identifier": { "PURL": "pkg:npm/bare-stream@2.13.0", "UID": "896f164458f03dfd" }, "Version": "2.13.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-stream@2.13.0+60a65b85d4dbf2df/node_modules/bare-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bare-url@2.4.1", "Name": "bare-url", "Identifier": { "PURL": "pkg:npm/bare-url@2.4.1", "UID": "be899d6b788c3602" }, "Version": "2.4.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bare-url@2.4.1/node_modules/bare-url/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "base64-js@1.5.1", "Name": "base64-js", "Identifier": { "PURL": "pkg:npm/base64-js@1.5.1", "UID": "eb06509ab24428ab" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/base64-js@1.5.1/node_modules/base64-js/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "baseline-browser-mapping@2.10.10", "Name": "baseline-browser-mapping", "Identifier": { "PURL": "pkg:npm/baseline-browser-mapping@2.10.10", "UID": "de461a3ea7ebb24a" }, "Version": "2.10.10", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/baseline-browser-mapping@2.10.10/node_modules/baseline-browser-mapping/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bcrypt-pbkdf@1.0.2", "Name": "bcrypt-pbkdf", "Identifier": { "PURL": "pkg:npm/bcrypt-pbkdf@1.0.2", "UID": "6a15be80674e8e9" }, "Version": "1.0.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bcrypt-pbkdf@1.0.2/node_modules/bcrypt-pbkdf/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "benchmark@1.0.0", "Name": "benchmark", "Identifier": { "PURL": "pkg:npm/benchmark@1.0.0", "UID": "12faf56bc96b1887" }, "Version": "1.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/benchmark/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "better-auth@1.5.6", "Name": "better-auth", "Identifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "Version": "1.5.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "better-call@1.3.2", "Name": "better-call", "Identifier": { "PURL": "pkg:npm/better-call@1.3.2", "UID": "ee7681bbcd17beaa" }, "Version": "1.3.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/better-call@1.3.2+3c5d820c62823f0b/node_modules/better-call/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "binary-extensions@2.3.0", "Name": "binary-extensions", "Identifier": { "PURL": "pkg:npm/binary-extensions@2.3.0", "UID": "976cb0fd7bc16b04" }, "Version": "2.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/binary-extensions@2.3.0/node_modules/binary-extensions/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bl@4.1.0", "Name": "bl", "Identifier": { "PURL": "pkg:npm/bl@4.1.0", "UID": "fd6439d44b802bc2" }, "Version": "4.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bl@4.1.0/node_modules/bl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "body-parser@2.3.0", "Name": "body-parser", "Identifier": { "PURL": "pkg:npm/body-parser@2.3.0", "UID": "8e5348c4b38348cc" }, "Version": "2.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/body-parser@2.3.0/node_modules/body-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "brace-expansion@2.1.0", "Name": "brace-expansion", "Identifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "Version": "2.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "brace-expansion@5.0.5", "Name": "brace-expansion", "Identifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "Version": "5.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "braces@3.0.3", "Name": "braces", "Identifier": { "PURL": "pkg:npm/braces@3.0.3", "UID": "8dc61a2a042ef92e" }, "Version": "3.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/braces@3.0.3/node_modules/braces/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "browserslist@4.28.1", "Name": "browserslist", "Identifier": { "PURL": "pkg:npm/browserslist@4.28.1", "UID": "e478147711353835" }, "Version": "4.28.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/browserslist@4.28.1+044c74c876d36fc3/node_modules/browserslist/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "buffer@5.7.1", "Name": "buffer", "Identifier": { "PURL": "pkg:npm/buffer@5.7.1", "UID": "d9dac8d2b1e654af" }, "Version": "5.7.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/buffer@5.7.1/node_modules/buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "buffer@6.0.3", "Name": "buffer", "Identifier": { "PURL": "pkg:npm/buffer@6.0.3", "UID": "aa8985da94734075" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/buffer@6.0.3/node_modules/buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "buffer-crc32@1.0.0", "Name": "buffer-crc32", "Identifier": { "PURL": "pkg:npm/buffer-crc32@1.0.0", "UID": "e4d5242a52e39b70" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/buffer-crc32@1.0.0/node_modules/buffer-crc32/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "buffer-from@1.1.2", "Name": "buffer-from", "Identifier": { "PURL": "pkg:npm/buffer-from@1.1.2", "UID": "365d2c2eabba0fec" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/buffer-from@1.1.2/node_modules/buffer-from/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "buildcheck@0.0.7", "Name": "buildcheck", "Identifier": { "PURL": "pkg:npm/buildcheck@0.0.7", "UID": "bcd6a783d5729fa9" }, "Version": "0.0.7", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/buildcheck@0.0.7/node_modules/buildcheck/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bullmq@5.71.0", "Name": "bullmq", "Identifier": { "PURL": "pkg:npm/bullmq@5.71.0", "UID": "63c7c83ffb8073d6" }, "Version": "5.71.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bullmq@5.71.0/node_modules/bullmq/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "byline@5.0.0", "Name": "byline", "Identifier": { "PURL": "pkg:npm/byline@5.0.0", "UID": "c2af5643f6370a7e" }, "Version": "5.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/byline@5.0.0/node_modules/byline/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bytes@3.1.2", "Name": "bytes", "Identifier": { "PURL": "pkg:npm/bytes@3.1.2", "UID": "3ee88abbd2d9772b" }, "Version": "3.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/bytes@3.1.2/node_modules/bytes/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "call-bind-apply-helpers@1.0.2", "Name": "call-bind-apply-helpers", "Identifier": { "PURL": "pkg:npm/call-bind-apply-helpers@1.0.2", "UID": "7102ea8828d71219" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/call-bind-apply-helpers@1.0.2/node_modules/call-bind-apply-helpers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "call-bound@1.0.4", "Name": "call-bound", "Identifier": { "PURL": "pkg:npm/call-bound@1.0.4", "UID": "581d55fde4c2c452" }, "Version": "1.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/call-bound@1.0.4/node_modules/call-bound/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "camelcase@5.3.1", "Name": "camelcase", "Identifier": { "PURL": "pkg:npm/camelcase@5.3.1", "UID": "469f33beabda0b08" }, "Version": "5.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/camelcase@5.3.1/node_modules/camelcase/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "caniuse-lite@1.0.30001781", "Name": "caniuse-lite", "Identifier": { "PURL": "pkg:npm/caniuse-lite@1.0.30001781", "UID": "bb6fb9d3fd54c388" }, "Version": "1.0.30001781", "Licenses": [ "CC-BY-4.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/caniuse-lite@1.0.30001781/node_modules/caniuse-lite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "chai@6.2.2", "Name": "chai", "Identifier": { "PURL": "pkg:npm/chai@6.2.2", "UID": "54faca736a798dff" }, "Version": "6.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/chai@6.2.2/node_modules/chai/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "chokidar@3.6.0", "Name": "chokidar", "Identifier": { "PURL": "pkg:npm/chokidar@3.6.0", "UID": "3081cc0cde05a3db" }, "Version": "3.6.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/chokidar@3.6.0/node_modules/chokidar/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "chownr@1.1.4", "Name": "chownr", "Identifier": { "PURL": "pkg:npm/chownr@1.1.4", "UID": "9ad25d0a624018ba" }, "Version": "1.1.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/chownr@1.1.4/node_modules/chownr/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "chownr@3.0.0", "Name": "chownr", "Identifier": { "PURL": "pkg:npm/chownr@3.0.0", "UID": "b445339e07b4abb1" }, "Version": "3.0.0", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/chownr@3.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cjs-module-lexer@2.2.0", "Name": "cjs-module-lexer", "Identifier": { "PURL": "pkg:npm/cjs-module-lexer@2.2.0", "UID": "34339e4047ee350e" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cjs-module-lexer@2.2.0/node_modules/cjs-module-lexer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "class-variance-authority@0.7.1", "Name": "class-variance-authority", "Identifier": { "PURL": "pkg:npm/class-variance-authority@0.7.1", "UID": "3e5af128663593c9" }, "Version": "0.7.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/class-variance-authority@0.7.1/node_modules/class-variance-authority/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cliui@6.0.0", "Name": "cliui", "Identifier": { "PURL": "pkg:npm/cliui@6.0.0", "UID": "c4f6ae5bc3768117" }, "Version": "6.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cliui@6.0.0/node_modules/cliui/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cliui@8.0.1", "Name": "cliui", "Identifier": { "PURL": "pkg:npm/cliui@8.0.1", "UID": "8a9196c00b356515" }, "Version": "8.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cliui@8.0.1/node_modules/cliui/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "clsx@2.1.1", "Name": "clsx", "Identifier": { "PURL": "pkg:npm/clsx@2.1.1", "UID": "23a5d0f3d9e82d32" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/clsx@2.1.1/node_modules/clsx/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cluster-key-slot@1.1.2", "Name": "cluster-key-slot", "Identifier": { "PURL": "pkg:npm/cluster-key-slot@1.1.2", "UID": "380f4119d39c59e9" }, "Version": "1.1.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "color-convert@2.0.1", "Name": "color-convert", "Identifier": { "PURL": "pkg:npm/color-convert@2.0.1", "UID": "7d2b0536ee069adf" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/color-convert@2.0.1/node_modules/color-convert/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "color-name@1.1.4", "Name": "color-name", "Identifier": { "PURL": "pkg:npm/color-name@1.1.4", "UID": "4f9e2e917532c8c4" }, "Version": "1.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/color-name@1.1.4/node_modules/color-name/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "compress-commons@6.0.2", "Name": "compress-commons", "Identifier": { "PURL": "pkg:npm/compress-commons@6.0.2", "UID": "bb5f5e3a3b4621a1" }, "Version": "6.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/compress-commons@6.0.2/node_modules/compress-commons/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "content-disposition@1.1.0", "Name": "content-disposition", "Identifier": { "PURL": "pkg:npm/content-disposition@1.1.0", "UID": "4873c7d2012afb96" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/content-disposition@1.1.0/node_modules/content-disposition/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "content-type@1.0.5", "Name": "content-type", "Identifier": { "PURL": "pkg:npm/content-type@1.0.5", "UID": "d569b897cd7b48f4" }, "Version": "1.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/content-type@1.0.5/node_modules/content-type/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "content-type@2.0.0", "Name": "content-type", "Identifier": { "PURL": "pkg:npm/content-type@2.0.0", "UID": "d53c8410f2a0d016" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/content-type@2.0.0/node_modules/content-type/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "convert-source-map@2.0.0", "Name": "convert-source-map", "Identifier": { "PURL": "pkg:npm/convert-source-map@2.0.0", "UID": "74e1de06c0d3dc50" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/convert-source-map@2.0.0/node_modules/convert-source-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cookie@0.7.2", "Name": "cookie", "Identifier": { "PURL": "pkg:npm/cookie@0.7.2", "UID": "ee027e30d0a45050" }, "Version": "0.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cookie@0.7.2/node_modules/cookie/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cookie-es@2.0.0", "Name": "cookie-es", "Identifier": { "PURL": "pkg:npm/cookie-es@2.0.0", "UID": "8428bd644b3d5c9" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cookie-es@2.0.0/node_modules/cookie-es/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cookie-signature@1.2.2", "Name": "cookie-signature", "Identifier": { "PURL": "pkg:npm/cookie-signature@1.2.2", "UID": "42d71a4600b838cb" }, "Version": "1.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cookie-signature@1.2.2/node_modules/cookie-signature/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "core-util-is@1.0.3", "Name": "core-util-is", "Identifier": { "PURL": "pkg:npm/core-util-is@1.0.3", "UID": "56accac555b19177" }, "Version": "1.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/core-util-is@1.0.3/node_modules/core-util-is/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cors@2.8.6", "Name": "cors", "Identifier": { "PURL": "pkg:npm/cors@2.8.6", "UID": "8e128f3900ecd97d" }, "Version": "2.8.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cors@2.8.6/node_modules/cors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cpu-features@0.0.10", "Name": "cpu-features", "Identifier": { "PURL": "pkg:npm/cpu-features@0.0.10", "UID": "1e1cc4a531a33118" }, "Version": "0.0.10", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/cpu-features@0.0.10@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "crc-32@1.2.2", "Name": "crc-32", "Identifier": { "PURL": "pkg:npm/crc-32@1.2.2", "UID": "e969a89d4399a641" }, "Version": "1.2.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/crc-32@1.2.2/node_modules/crc-32/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "crc32-stream@6.0.0", "Name": "crc32-stream", "Identifier": { "PURL": "pkg:npm/crc32-stream@6.0.0", "UID": "de4f5da72a1b2fa" }, "Version": "6.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/crc32-stream@6.0.0/node_modules/crc32-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cron-parser@4.9.0", "Name": "cron-parser", "Identifier": { "PURL": "pkg:npm/cron-parser@4.9.0", "UID": "84dad0961cbcfe2f" }, "Version": "4.9.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cron-parser@4.9.0/node_modules/cron-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cross-spawn@7.0.6", "Name": "cross-spawn", "Identifier": { "PURL": "pkg:npm/cross-spawn@7.0.6", "UID": "c509e74b066c2c11" }, "Version": "7.0.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/cross-spawn@7.0.6/node_modules/cross-spawn/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "csstype@3.2.3", "Name": "csstype", "Identifier": { "PURL": "pkg:npm/csstype@3.2.3", "UID": "1f2e46a0cfd41255" }, "Version": "3.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/csstype@3.2.3/node_modules/csstype/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-array@3.2.4", "Name": "d3-array", "Identifier": { "PURL": "pkg:npm/d3-array@3.2.4", "UID": "37a53683008f3c05" }, "Version": "3.2.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-array@3.2.4/node_modules/d3-array/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-color@3.1.0", "Name": "d3-color", "Identifier": { "PURL": "pkg:npm/d3-color@3.1.0", "UID": "b40058e5a0f8121" }, "Version": "3.1.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-color@3.1.0/node_modules/d3-color/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-ease@3.0.1", "Name": "d3-ease", "Identifier": { "PURL": "pkg:npm/d3-ease@3.0.1", "UID": "24d81bf4b28b06a6" }, "Version": "3.0.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-ease@3.0.1/node_modules/d3-ease/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-format@3.1.2", "Name": "d3-format", "Identifier": { "PURL": "pkg:npm/d3-format@3.1.2", "UID": "1371a3db31a81fad" }, "Version": "3.1.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-format@3.1.2/node_modules/d3-format/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-interpolate@3.0.1", "Name": "d3-interpolate", "Identifier": { "PURL": "pkg:npm/d3-interpolate@3.0.1", "UID": "280e53981c4583ea" }, "Version": "3.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-interpolate@3.0.1/node_modules/d3-interpolate/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-path@3.1.0", "Name": "d3-path", "Identifier": { "PURL": "pkg:npm/d3-path@3.1.0", "UID": "a30ea4650cce0052" }, "Version": "3.1.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-path@3.1.0/node_modules/d3-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-scale@4.0.2", "Name": "d3-scale", "Identifier": { "PURL": "pkg:npm/d3-scale@4.0.2", "UID": "1c17c08ec1329c43" }, "Version": "4.0.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-scale@4.0.2/node_modules/d3-scale/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-shape@3.2.0", "Name": "d3-shape", "Identifier": { "PURL": "pkg:npm/d3-shape@3.2.0", "UID": "45751ee586d5a044" }, "Version": "3.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-shape@3.2.0/node_modules/d3-shape/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-time@3.1.0", "Name": "d3-time", "Identifier": { "PURL": "pkg:npm/d3-time@3.1.0", "UID": "7a621054b4d55441" }, "Version": "3.1.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-time@3.1.0/node_modules/d3-time/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-time-format@4.1.0", "Name": "d3-time-format", "Identifier": { "PURL": "pkg:npm/d3-time-format@4.1.0", "UID": "4927d3e602f8585d" }, "Version": "4.1.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-time-format@4.1.0/node_modules/d3-time-format/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "d3-timer@3.0.1", "Name": "d3-timer", "Identifier": { "PURL": "pkg:npm/d3-timer@3.0.1", "UID": "ac31235e4aeeba1f" }, "Version": "3.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/d3-timer@3.0.1/node_modules/d3-timer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@4.4.3", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@4.4.3", "UID": "7f1387af436c050e" }, "Version": "4.4.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/debug@4.4.3/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "decamelize@1.2.0", "Name": "decamelize", "Identifier": { "PURL": "pkg:npm/decamelize@1.2.0", "UID": "633f9812f89415f" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/decamelize@1.2.0/node_modules/decamelize/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "decimal.js-light@2.5.1", "Name": "decimal.js-light", "Identifier": { "PURL": "pkg:npm/decimal.js-light@2.5.1", "UID": "b20352617ffc9e4a" }, "Version": "2.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/decimal.js-light@2.5.1/node_modules/decimal.js-light/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "defu@6.1.4", "Name": "defu", "Identifier": { "PURL": "pkg:npm/defu@6.1.4", "UID": "2a77ae4f20d5ff2a" }, "Version": "6.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/defu@6.1.4/node_modules/defu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "denque@2.1.0", "Name": "denque", "Identifier": { "PURL": "pkg:npm/denque@2.1.0", "UID": "b19df107c34309fb" }, "Version": "2.1.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/denque@2.1.0/node_modules/denque/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "depd@2.0.0", "Name": "depd", "Identifier": { "PURL": "pkg:npm/depd@2.0.0", "UID": "d8edfc570bbfc636" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/depd@2.0.0/node_modules/depd/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "detect-libc@2.1.2", "Name": "detect-libc", "Identifier": { "PURL": "pkg:npm/detect-libc@2.1.2", "UID": "cc41ad25425eb059" }, "Version": "2.1.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/detect-libc@2.1.2/node_modules/detect-libc/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "detect-node-es@1.1.0", "Name": "detect-node-es", "Identifier": { "PURL": "pkg:npm/detect-node-es@1.1.0", "UID": "c6ec0bdcfd7295c" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/detect-node-es@1.1.0/node_modules/detect-node-es/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "diff@8.0.3", "Name": "diff", "Identifier": { "PURL": "pkg:npm/diff@8.0.3", "UID": "a41546276c48aba2" }, "Version": "8.0.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/diff@8.0.3/node_modules/diff/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dijkstrajs@1.0.3", "Name": "dijkstrajs", "Identifier": { "PURL": "pkg:npm/dijkstrajs@1.0.3", "UID": "945b56ecbec969f2" }, "Version": "1.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/dijkstrajs@1.0.3/node_modules/dijkstrajs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "docker-compose@1.4.2", "Name": "docker-compose", "Identifier": { "PURL": "pkg:npm/docker-compose@1.4.2", "UID": "58d73ef5ae4ce2d7" }, "Version": "1.4.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/docker-compose@1.4.2/node_modules/docker-compose/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "docker-modem@5.0.7", "Name": "docker-modem", "Identifier": { "PURL": "pkg:npm/docker-modem@5.0.7", "UID": "6253982a52bcbcf6" }, "Version": "5.0.7", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/docker-modem@5.0.7/node_modules/docker-modem/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dockerode@4.0.10", "Name": "dockerode", "Identifier": { "PURL": "pkg:npm/dockerode@4.0.10", "UID": "db096ea7312a5236" }, "Version": "4.0.10", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/dockerode@4.0.10/node_modules/dockerode/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dompurify@3.4.12", "Name": "dompurify", "Identifier": { "PURL": "pkg:npm/dompurify@3.4.12", "UID": "eb89d0641cfa791b" }, "Version": "3.4.12", "Licenses": [ "(MPL-2.0 OR Apache-2.0)" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/dompurify@3.4.12/node_modules/dompurify/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "drizzle-kit@0.31.10", "Name": "drizzle-kit", "Identifier": { "PURL": "pkg:npm/drizzle-kit@0.31.10", "UID": "af8259de53b15f62" }, "Version": "0.31.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/drizzle-kit@0.31.10/node_modules/drizzle-kit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "drizzle-orm@0.45.1", "Name": "drizzle-orm", "Identifier": { "PURL": "pkg:npm/drizzle-orm@0.45.1", "UID": "13ed531c5ff872db" }, "Version": "0.45.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/drizzle-orm@0.45.1+22def57015774fd9/node_modules/drizzle-orm/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dunder-proto@1.0.1", "Name": "dunder-proto", "Identifier": { "PURL": "pkg:npm/dunder-proto@1.0.1", "UID": "dea3cf66c1e5c5fa" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/dunder-proto@1.0.1/node_modules/dunder-proto/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "eastasianwidth@0.2.0", "Name": "eastasianwidth", "Identifier": { "PURL": "pkg:npm/eastasianwidth@0.2.0", "UID": "757f729f3982cb1e" }, "Version": "0.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/eastasianwidth@0.2.0/node_modules/eastasianwidth/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ee-first@1.1.1", "Name": "ee-first", "Identifier": { "PURL": "pkg:npm/ee-first@1.1.1", "UID": "bc2806bc4998b04" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ee-first@1.1.1/node_modules/ee-first/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "electron-to-chromium@1.5.321", "Name": "electron-to-chromium", "Identifier": { "PURL": "pkg:npm/electron-to-chromium@1.5.321", "UID": "d3ca607c600d2ab" }, "Version": "1.5.321", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/electron-to-chromium@1.5.321/node_modules/electron-to-chromium/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "emoji-regex@8.0.0", "Name": "emoji-regex", "Identifier": { "PURL": "pkg:npm/emoji-regex@8.0.0", "UID": "3cfea8312552ecf9" }, "Version": "8.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/emoji-regex@8.0.0/node_modules/emoji-regex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "emoji-regex@9.2.2", "Name": "emoji-regex", "Identifier": { "PURL": "pkg:npm/emoji-regex@9.2.2", "UID": "ff35b757c06f126" }, "Version": "9.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/emoji-regex@9.2.2/node_modules/emoji-regex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "encodeurl@2.0.0", "Name": "encodeurl", "Identifier": { "PURL": "pkg:npm/encodeurl@2.0.0", "UID": "ebfc12b555d6f67f" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/encodeurl@2.0.0/node_modules/encodeurl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "end-of-stream@1.4.5", "Name": "end-of-stream", "Identifier": { "PURL": "pkg:npm/end-of-stream@1.4.5", "UID": "d9d43bb1acb57b70" }, "Version": "1.4.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/end-of-stream@1.4.5/node_modules/end-of-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "enhanced-resolve@5.20.1", "Name": "enhanced-resolve", "Identifier": { "PURL": "pkg:npm/enhanced-resolve@5.20.1", "UID": "a11f556988cbcc86" }, "Version": "5.20.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/enhanced-resolve@5.20.1/node_modules/enhanced-resolve/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "env-paths@2.2.1", "Name": "env-paths", "Identifier": { "PURL": "pkg:npm/env-paths@2.2.1", "UID": "9e3af28ba48462dc" }, "Version": "2.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/env-paths@2.2.1@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-define-property@1.0.1", "Name": "es-define-property", "Identifier": { "PURL": "pkg:npm/es-define-property@1.0.1", "UID": "727d9c99e58d4290" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/es-define-property@1.0.1/node_modules/es-define-property/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-errors@1.3.0", "Name": "es-errors", "Identifier": { "PURL": "pkg:npm/es-errors@1.3.0", "UID": "ea99cabd00a2026e" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/es-errors@1.3.0/node_modules/es-errors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-module-lexer@2.0.0", "Name": "es-module-lexer", "Identifier": { "PURL": "pkg:npm/es-module-lexer@2.0.0", "UID": "8f1c7d69173ae7cc" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/es-module-lexer@2.0.0/node_modules/es-module-lexer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-object-atoms@1.1.2", "Name": "es-object-atoms", "Identifier": { "PURL": "pkg:npm/es-object-atoms@1.1.2", "UID": "fe3c949f1600a008" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/es-object-atoms@1.1.2/node_modules/es-object-atoms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-toolkit@1.45.1", "Name": "es-toolkit", "Identifier": { "PURL": "pkg:npm/es-toolkit@1.45.1", "UID": "c0894e2d192b0227" }, "Version": "1.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/es-toolkit@1.45.1/node_modules/es-toolkit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "esbuild@0.18.20", "Name": "esbuild", "Identifier": { "PURL": "pkg:npm/esbuild@0.18.20", "UID": "e7927220539ab9a3" }, "Version": "0.18.20", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/esbuild@0.18.20/node_modules/esbuild/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "esbuild@0.25.12", "Name": "esbuild", "Identifier": { "PURL": "pkg:npm/esbuild@0.25.12", "UID": "b1fbc6a0699506bb" }, "Version": "0.25.12", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/esbuild@0.25.12/node_modules/esbuild/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "esbuild@0.27.4", "Name": "esbuild", "Identifier": { "PURL": "pkg:npm/esbuild@0.27.4", "UID": "3dbdc0fd1842c6df" }, "Version": "0.27.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/esbuild@0.27.4/node_modules/esbuild/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "escalade@3.2.0", "Name": "escalade", "Identifier": { "PURL": "pkg:npm/escalade@3.2.0", "UID": "aea58b34c971eae2" }, "Version": "3.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/escalade@3.2.0/node_modules/escalade/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "escape-html@1.0.3", "Name": "escape-html", "Identifier": { "PURL": "pkg:npm/escape-html@1.0.3", "UID": "743f092b715f3212" }, "Version": "1.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/escape-html@1.0.3/node_modules/escape-html/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "esprima@4.0.1", "Name": "esprima", "Identifier": { "PURL": "pkg:npm/esprima@4.0.1", "UID": "d711afa1e0f27ec1" }, "Version": "4.0.1", "Licenses": [ "BSD-2-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/esprima@4.0.1/node_modules/esprima/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "estree-walker@3.0.3", "Name": "estree-walker", "Identifier": { "PURL": "pkg:npm/estree-walker@3.0.3", "UID": "a44114105b0b6486" }, "Version": "3.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/estree-walker@3.0.3/node_modules/estree-walker/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "etag@1.8.1", "Name": "etag", "Identifier": { "PURL": "pkg:npm/etag@1.8.1", "UID": "a1d32be7e7995e47" }, "Version": "1.8.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/etag@1.8.1/node_modules/etag/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "event-target-shim@5.0.1", "Name": "event-target-shim", "Identifier": { "PURL": "pkg:npm/event-target-shim@5.0.1", "UID": "2eba6d4215669acf" }, "Version": "5.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/event-target-shim@5.0.1/node_modules/event-target-shim/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "eventemitter3@5.0.4", "Name": "eventemitter3", "Identifier": { "PURL": "pkg:npm/eventemitter3@5.0.4", "UID": "ba0647f1b6f840d3" }, "Version": "5.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/eventemitter3@5.0.4/node_modules/eventemitter3/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "events@3.3.0", "Name": "events", "Identifier": { "PURL": "pkg:npm/events@3.3.0", "UID": "867383c27801d79a" }, "Version": "3.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/events@3.3.0/node_modules/events/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "events-universal@1.0.1", "Name": "events-universal", "Identifier": { "PURL": "pkg:npm/events-universal@1.0.1", "UID": "38be9ed176fd747b" }, "Version": "1.0.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/events-universal@1.0.1/node_modules/events-universal/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "eventsource@3.0.7", "Name": "eventsource", "Identifier": { "PURL": "pkg:npm/eventsource@3.0.7", "UID": "dd75fb03b499647e" }, "Version": "3.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/eventsource@3.0.7/node_modules/eventsource/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "eventsource-parser@3.1.0", "Name": "eventsource-parser", "Identifier": { "PURL": "pkg:npm/eventsource-parser@3.1.0", "UID": "d87e159a8c6af141" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/eventsource-parser@3.1.0/node_modules/eventsource-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "expect-type@1.3.0", "Name": "expect-type", "Identifier": { "PURL": "pkg:npm/expect-type@1.3.0", "UID": "83dae5667d7b0dad" }, "Version": "1.3.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/expect-type@1.3.0/node_modules/expect-type/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "exponential-backoff@3.1.3", "Name": "exponential-backoff", "Identifier": { "PURL": "pkg:npm/exponential-backoff@3.1.3", "UID": "97093f980e9b7679" }, "Version": "3.1.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/exponential-backoff@3.1.3@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "express@5.2.1", "Name": "express", "Identifier": { "PURL": "pkg:npm/express@5.2.1", "UID": "1a094a1e384a2662" }, "Version": "5.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/express@5.2.1/node_modules/express/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "express-rate-limit@8.6.2", "Name": "express-rate-limit", "Identifier": { "PURL": "pkg:npm/express-rate-limit@8.6.2", "UID": "347aa5c02f3df442" }, "Version": "8.6.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/express-rate-limit@8.6.2+c43b725b96c226ad/node_modules/express-rate-limit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fast-deep-equal@3.1.3", "Name": "fast-deep-equal", "Identifier": { "PURL": "pkg:npm/fast-deep-equal@3.1.3", "UID": "5e43a4b358584a56" }, "Version": "3.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fast-deep-equal@3.1.3/node_modules/fast-deep-equal/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fast-equals@5.4.1", "Name": "fast-equals", "Identifier": { "PURL": "pkg:npm/fast-equals@5.4.1", "UID": "8a380641a4573903" }, "Version": "5.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fast-equals@5.4.1/node_modules/fast-equals/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fast-fifo@1.3.2", "Name": "fast-fifo", "Identifier": { "PURL": "pkg:npm/fast-fifo@1.3.2", "UID": "e85ed15ef32420fc" }, "Version": "1.3.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fast-fifo@1.3.2/node_modules/fast-fifo/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fast-uri@3.1.5", "Name": "fast-uri", "Identifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "Version": "3.1.5", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fdir@6.5.0", "Name": "fdir", "Identifier": { "PURL": "pkg:npm/fdir@6.5.0", "UID": "dcfbf4d06946d441" }, "Version": "6.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fdir@6.5.0+a185e370e160e74e/node_modules/fdir/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fill-range@7.1.1", "Name": "fill-range", "Identifier": { "PURL": "pkg:npm/fill-range@7.1.1", "UID": "cc73daea43d36ff0" }, "Version": "7.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fill-range@7.1.1/node_modules/fill-range/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "finalhandler@2.1.1", "Name": "finalhandler", "Identifier": { "PURL": "pkg:npm/finalhandler@2.1.1", "UID": "3294061f8a257f36" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/finalhandler@2.1.1/node_modules/finalhandler/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "find-up@4.1.0", "Name": "find-up", "Identifier": { "PURL": "pkg:npm/find-up@4.1.0", "UID": "1602a41d513eebac" }, "Version": "4.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/find-up@4.1.0/node_modules/find-up/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "foreground-child@3.3.1", "Name": "foreground-child", "Identifier": { "PURL": "pkg:npm/foreground-child@3.3.1", "UID": "525f9fbe30747624" }, "Version": "3.3.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/foreground-child@3.3.1/node_modules/foreground-child/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "forwarded@0.2.0", "Name": "forwarded", "Identifier": { "PURL": "pkg:npm/forwarded@0.2.0", "UID": "22565701cb0ded82" }, "Version": "0.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/forwarded@0.2.0/node_modules/forwarded/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "forwarded-parse@2.1.2", "Name": "forwarded-parse", "Identifier": { "PURL": "pkg:npm/forwarded-parse@2.1.2", "UID": "f392fc377f4d833e" }, "Version": "2.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/forwarded-parse@2.1.2/node_modules/forwarded-parse/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fresh@2.0.0", "Name": "fresh", "Identifier": { "PURL": "pkg:npm/fresh@2.0.0", "UID": "7c361df789166cb8" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fresh@2.0.0/node_modules/fresh/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fs-constants@1.0.0", "Name": "fs-constants", "Identifier": { "PURL": "pkg:npm/fs-constants@1.0.0", "UID": "dd6be71fa8236db4" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/fs-constants@1.0.0/node_modules/fs-constants/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "function-bind@1.1.2", "Name": "function-bind", "Identifier": { "PURL": "pkg:npm/function-bind@1.1.2", "UID": "2dbf8bdbf1288d26" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/function-bind@1.1.2/node_modules/function-bind/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "gensync@1.0.0-beta.2", "Name": "gensync", "Identifier": { "PURL": "pkg:npm/gensync@1.0.0-beta.2", "UID": "75d7fdfdb57fcdfe" }, "Version": "1.0.0-beta.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/gensync@1.0.0-beta.2/node_modules/gensync/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-caller-file@2.0.5", "Name": "get-caller-file", "Identifier": { "PURL": "pkg:npm/get-caller-file@2.0.5", "UID": "fbac872fd138ee3a" }, "Version": "2.0.5", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-caller-file@2.0.5/node_modules/get-caller-file/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-intrinsic@1.3.0", "Name": "get-intrinsic", "Identifier": { "PURL": "pkg:npm/get-intrinsic@1.3.0", "UID": "81a623bed7f7b2cc" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-intrinsic@1.3.0/node_modules/get-intrinsic/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-nonce@1.0.1", "Name": "get-nonce", "Identifier": { "PURL": "pkg:npm/get-nonce@1.0.1", "UID": "13f8d79d8b91cfb6" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-nonce@1.0.1/node_modules/get-nonce/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-port@7.2.0", "Name": "get-port", "Identifier": { "PURL": "pkg:npm/get-port@7.2.0", "UID": "a2cc86d148d8996e" }, "Version": "7.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-port@7.2.0/node_modules/get-port/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-proto@1.0.1", "Name": "get-proto", "Identifier": { "PURL": "pkg:npm/get-proto@1.0.1", "UID": "212934dd387f84c8" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-proto@1.0.1/node_modules/get-proto/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-tsconfig@4.13.7", "Name": "get-tsconfig", "Identifier": { "PURL": "pkg:npm/get-tsconfig@4.13.7", "UID": "e0ec74535b145131" }, "Version": "4.13.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/get-tsconfig@4.13.7/node_modules/get-tsconfig/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "glob@10.5.0", "Name": "glob", "Identifier": { "PURL": "pkg:npm/glob@10.5.0", "UID": "f60df294807e5fa7" }, "Version": "10.5.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/glob@10.5.0/node_modules/glob/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "glob-parent@5.1.2", "Name": "glob-parent", "Identifier": { "PURL": "pkg:npm/glob-parent@5.1.2", "UID": "9e692f894c40e629" }, "Version": "5.1.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/glob-parent@5.1.2/node_modules/glob-parent/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "gopd@1.2.0", "Name": "gopd", "Identifier": { "PURL": "pkg:npm/gopd@1.2.0", "UID": "f9f6bc48891e9b21" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/gopd@1.2.0/node_modules/gopd/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "graceful-fs@4.2.11", "Name": "graceful-fs", "Identifier": { "PURL": "pkg:npm/graceful-fs@4.2.11", "UID": "282902562f14b95e" }, "Version": "4.2.11", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "gsap@3.15.0", "Name": "gsap", "Identifier": { "PURL": "pkg:npm/gsap@3.15.0", "UID": "1222dbd823467b06" }, "Version": "3.15.0", "Licenses": [ "Standard 'no charge' license: https://gsap.com/standard-license." ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/gsap@3.15.0/node_modules/gsap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "has-symbols@1.1.0", "Name": "has-symbols", "Identifier": { "PURL": "pkg:npm/has-symbols@1.1.0", "UID": "e2b99c7c481b60d5" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/has-symbols@1.1.0/node_modules/has-symbols/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "hasown@2.0.4", "Name": "hasown", "Identifier": { "PURL": "pkg:npm/hasown@2.0.4", "UID": "f719f8524507150" }, "Version": "2.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/hasown@2.0.4/node_modules/hasown/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "hono@4.12.8", "Name": "hono", "Identifier": { "PURL": "pkg:npm/hono@4.12.8", "UID": "ec3033b8a3af68ab" }, "Version": "4.12.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/hono@4.12.8/node_modules/hono/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "http-errors@2.0.1", "Name": "http-errors", "Identifier": { "PURL": "pkg:npm/http-errors@2.0.1", "UID": "5a8c3a79af0c0b79" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/http-errors@2.0.1/node_modules/http-errors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "iconv-lite@0.7.3", "Name": "iconv-lite", "Identifier": { "PURL": "pkg:npm/iconv-lite@0.7.3", "UID": "a8cada7d56a5ce83" }, "Version": "0.7.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/iconv-lite@0.7.3/node_modules/iconv-lite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ieee754@1.2.1", "Name": "ieee754", "Identifier": { "PURL": "pkg:npm/ieee754@1.2.1", "UID": "5b2324a9c6fe5627" }, "Version": "1.2.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ieee754@1.2.1/node_modules/ieee754/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "immer@10.2.0", "Name": "immer", "Identifier": { "PURL": "pkg:npm/immer@10.2.0", "UID": "5031085c6f21b602" }, "Version": "10.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/immer@10.2.0/node_modules/immer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "immer@11.1.4", "Name": "immer", "Identifier": { "PURL": "pkg:npm/immer@11.1.4", "UID": "622721f7a919e569" }, "Version": "11.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/immer@11.1.4/node_modules/immer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "import-in-the-middle@2.0.6", "Name": "import-in-the-middle", "Identifier": { "PURL": "pkg:npm/import-in-the-middle@2.0.6", "UID": "5a7565ae8bf3a529" }, "Version": "2.0.6", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/import-in-the-middle@2.0.6/node_modules/import-in-the-middle/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "import-in-the-middle@3.0.1", "Name": "import-in-the-middle", "Identifier": { "PURL": "pkg:npm/import-in-the-middle@3.0.1", "UID": "cbb242d6ab675569" }, "Version": "3.0.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/import-in-the-middle@3.0.1/node_modules/import-in-the-middle/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "inherits@2.0.4", "Name": "inherits", "Identifier": { "PURL": "pkg:npm/inherits@2.0.4", "UID": "f5d392fa46de27c2" }, "Version": "2.0.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/inherits@2.0.4/node_modules/inherits/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "internmap@2.0.3", "Name": "internmap", "Identifier": { "PURL": "pkg:npm/internmap@2.0.3", "UID": "a43c0d2d45e01c82" }, "Version": "2.0.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/internmap@2.0.3/node_modules/internmap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ioredis@5.10.1", "Name": "ioredis", "Identifier": { "PURL": "pkg:npm/ioredis@5.10.1", "UID": "b7139b5018a32130" }, "Version": "5.10.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ioredis@5.10.1/node_modules/ioredis/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ioredis@5.9.3", "Name": "ioredis", "Identifier": { "PURL": "pkg:npm/ioredis@5.9.3", "UID": "cdd4734105c0b94b" }, "Version": "5.9.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ioredis@5.9.3/node_modules/ioredis/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ip-address@10.4.0", "Name": "ip-address", "Identifier": { "PURL": "pkg:npm/ip-address@10.4.0", "UID": "2580019204bc1caa" }, "Version": "10.4.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ip-address@10.4.0/node_modules/ip-address/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ipaddr.js@1.9.1", "Name": "ipaddr.js", "Identifier": { "PURL": "pkg:npm/ipaddr.js@1.9.1", "UID": "54be8ef18bc548f9" }, "Version": "1.9.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ipaddr.js@1.9.1/node_modules/ipaddr.js/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-binary-path@2.1.0", "Name": "is-binary-path", "Identifier": { "PURL": "pkg:npm/is-binary-path@2.1.0", "UID": "dfa14b022901b97e" }, "Version": "2.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-binary-path@2.1.0/node_modules/is-binary-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-extglob@2.1.1", "Name": "is-extglob", "Identifier": { "PURL": "pkg:npm/is-extglob@2.1.1", "UID": "c85c2693fc7de4cb" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-extglob@2.1.1/node_modules/is-extglob/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-fullwidth-code-point@3.0.0", "Name": "is-fullwidth-code-point", "Identifier": { "PURL": "pkg:npm/is-fullwidth-code-point@3.0.0", "UID": "fbd7333aaa9660a" }, "Version": "3.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-fullwidth-code-point@3.0.0/node_modules/is-fullwidth-code-point/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-glob@4.0.3", "Name": "is-glob", "Identifier": { "PURL": "pkg:npm/is-glob@4.0.3", "UID": "8109aff71e9096ef" }, "Version": "4.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-glob@4.0.3/node_modules/is-glob/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-number@7.0.0", "Name": "is-number", "Identifier": { "PURL": "pkg:npm/is-number@7.0.0", "UID": "561f2c5669a60b61" }, "Version": "7.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-number@7.0.0/node_modules/is-number/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-promise@4.0.0", "Name": "is-promise", "Identifier": { "PURL": "pkg:npm/is-promise@4.0.0", "UID": "bc3885a51af8d148" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-promise@4.0.0/node_modules/is-promise/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "is-stream@2.0.1", "Name": "is-stream", "Identifier": { "PURL": "pkg:npm/is-stream@2.0.1", "UID": "90160ae8d14696e0" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/is-stream@2.0.1/node_modules/is-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "isarray@1.0.0", "Name": "isarray", "Identifier": { "PURL": "pkg:npm/isarray@1.0.0", "UID": "824c2772b7cfcf91" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/isarray@1.0.0/node_modules/isarray/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "isbot@5.1.36", "Name": "isbot", "Identifier": { "PURL": "pkg:npm/isbot@5.1.36", "UID": "7936b3e4ea3dc299" }, "Version": "5.1.36", "Licenses": [ "Unlicense" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/isbot@5.1.36/node_modules/isbot/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "isexe@2.0.0", "Name": "isexe", "Identifier": { "PURL": "pkg:npm/isexe@2.0.0", "UID": "8c4b01e9cd5b853d" }, "Version": "2.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/isexe@2.0.0/node_modules/isexe/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "isexe@4.0.0", "Name": "isexe", "Identifier": { "PURL": "pkg:npm/isexe@4.0.0", "UID": "d92892163163a69" }, "Version": "4.0.0", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/isexe@4.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "jackspeak@3.4.3", "Name": "jackspeak", "Identifier": { "PURL": "pkg:npm/jackspeak@3.4.3", "UID": "91df2ff8a0470e6c" }, "Version": "3.4.3", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/jackspeak@3.4.3/node_modules/jackspeak/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "jiti@2.6.1", "Name": "jiti", "Identifier": { "PURL": "pkg:npm/jiti@2.6.1", "UID": "aafbd9a955831b31" }, "Version": "2.6.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/jiti@2.6.1/node_modules/jiti/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "jose@6.2.2", "Name": "jose", "Identifier": { "PURL": "pkg:npm/jose@6.2.2", "UID": "3082ca482733f469" }, "Version": "6.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/jose@6.2.2/node_modules/jose/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "js-tokens@4.0.0", "Name": "js-tokens", "Identifier": { "PURL": "pkg:npm/js-tokens@4.0.0", "UID": "a5009ab79461cb9" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/js-tokens@4.0.0/node_modules/js-tokens/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "jsesc@3.1.0", "Name": "jsesc", "Identifier": { "PURL": "pkg:npm/jsesc@3.1.0", "UID": "8a01fa216b5b486d" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/jsesc@3.1.0/node_modules/jsesc/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "json-schema-traverse@1.0.0", "Name": "json-schema-traverse", "Identifier": { "PURL": "pkg:npm/json-schema-traverse@1.0.0", "UID": "885818e9572a79da" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/json-schema-traverse@1.0.0/node_modules/json-schema-traverse/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "json-schema-typed@8.0.2", "Name": "json-schema-typed", "Identifier": { "PURL": "pkg:npm/json-schema-typed@8.0.2", "UID": "1a9f8ba08f2ae73a" }, "Version": "8.0.2", "Licenses": [ "BSD-2-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/json-schema-typed@8.0.2/node_modules/json-schema-typed/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "json5@2.2.3", "Name": "json5", "Identifier": { "PURL": "pkg:npm/json5@2.2.3", "UID": "feac570e377d4fff" }, "Version": "2.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/json5@2.2.3/node_modules/json5/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "kysely@0.28.14", "Name": "kysely", "Identifier": { "PURL": "pkg:npm/kysely@0.28.14", "UID": "f488c800fec58ae6" }, "Version": "0.28.14", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/kysely@0.28.14/node_modules/kysely/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lazystream@1.0.1", "Name": "lazystream", "Identifier": { "PURL": "pkg:npm/lazystream@1.0.1", "UID": "1746408984d09a9a" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lazystream@1.0.1/node_modules/lazystream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lefthook@2.1.4", "Name": "lefthook", "Identifier": { "PURL": "pkg:npm/lefthook@2.1.4", "UID": "c310ae79a75c8457" }, "Version": "2.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lefthook@2.1.4/node_modules/lefthook/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lefthook-linux-x64@2.1.4", "Name": "lefthook-linux-x64", "Identifier": { "PURL": "pkg:npm/lefthook-linux-x64@2.1.4", "UID": "9eefeb00bb23e73d" }, "Version": "2.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lefthook-linux-x64@2.1.4/node_modules/lefthook-linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lightningcss@1.32.0", "Name": "lightningcss", "Identifier": { "PURL": "pkg:npm/lightningcss@1.32.0", "UID": "9eb5449a36b8a855" }, "Version": "1.32.0", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lightningcss@1.32.0/node_modules/lightningcss/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lightningcss-linux-x64-gnu@1.32.0", "Name": "lightningcss-linux-x64-gnu", "Identifier": { "PURL": "pkg:npm/lightningcss-linux-x64-gnu@1.32.0", "UID": "94f24e0159bdf7cb" }, "Version": "1.32.0", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lightningcss-linux-x64-gnu@1.32.0/node_modules/lightningcss-linux-x64-gnu/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lightningcss-linux-x64-musl@1.32.0", "Name": "lightningcss-linux-x64-musl", "Identifier": { "PURL": "pkg:npm/lightningcss-linux-x64-musl@1.32.0", "UID": "a61fb30dece53561" }, "Version": "1.32.0", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lightningcss-linux-x64-musl@1.32.0/node_modules/lightningcss-linux-x64-musl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "linkifyjs@4.3.3", "Name": "linkifyjs", "Identifier": { "PURL": "pkg:npm/linkifyjs@4.3.3", "UID": "dd17acfc28c8b790" }, "Version": "4.3.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/linkifyjs@4.3.3/node_modules/linkifyjs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "locate-path@5.0.0", "Name": "locate-path", "Identifier": { "PURL": "pkg:npm/locate-path@5.0.0", "UID": "ea2f44f98b901661" }, "Version": "5.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/locate-path@5.0.0/node_modules/locate-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lodash@4.18.1", "Name": "lodash", "Identifier": { "PURL": "pkg:npm/lodash@4.18.1", "UID": "417999ae2a7b9af9" }, "Version": "4.18.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lodash@4.18.1/node_modules/lodash/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lodash.camelcase@4.3.0", "Name": "lodash.camelcase", "Identifier": { "PURL": "pkg:npm/lodash.camelcase@4.3.0", "UID": "4e119e19e029d4dc" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lodash.camelcase@4.3.0/node_modules/lodash.camelcase/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lodash.defaults@4.2.0", "Name": "lodash.defaults", "Identifier": { "PURL": "pkg:npm/lodash.defaults@4.2.0", "UID": "724096b5878411bc" }, "Version": "4.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lodash.defaults@4.2.0/node_modules/lodash.defaults/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lodash.isarguments@3.1.0", "Name": "lodash.isarguments", "Identifier": { "PURL": "pkg:npm/lodash.isarguments@3.1.0", "UID": "e696f1058166b9bb" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lodash.isarguments@3.1.0/node_modules/lodash.isarguments/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "long@5.3.2", "Name": "long", "Identifier": { "PURL": "pkg:npm/long@5.3.2", "UID": "aa1fec4f4852a0a" }, "Version": "5.3.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/long@5.3.2/node_modules/long/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lru-cache@10.4.3", "Name": "lru-cache", "Identifier": { "PURL": "pkg:npm/lru-cache@10.4.3", "UID": "6703a15f40886230" }, "Version": "10.4.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lru-cache@10.4.3/node_modules/lru-cache/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lru-cache@5.1.1", "Name": "lru-cache", "Identifier": { "PURL": "pkg:npm/lru-cache@5.1.1", "UID": "3823d02b4b2a487d" }, "Version": "5.1.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lru-cache@5.1.1/node_modules/lru-cache/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "lucide-react@0.475.0", "Name": "lucide-react", "Identifier": { "PURL": "pkg:npm/lucide-react@0.475.0", "UID": "5b645a0a799bab01" }, "Version": "0.475.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/lucide-react@0.475.0+b1ab299f0a400331/node_modules/lucide-react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "luxon@3.7.2", "Name": "luxon", "Identifier": { "PURL": "pkg:npm/luxon@3.7.2", "UID": "40a286497b31e0de" }, "Version": "3.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/luxon@3.7.2/node_modules/luxon/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "magic-string@0.30.21", "Name": "magic-string", "Identifier": { "PURL": "pkg:npm/magic-string@0.30.21", "UID": "22858e1816225836" }, "Version": "0.30.21", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/magic-string@0.30.21/node_modules/magic-string/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "math-intrinsics@1.1.0", "Name": "math-intrinsics", "Identifier": { "PURL": "pkg:npm/math-intrinsics@1.1.0", "UID": "de25cfdf18014857" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/math-intrinsics@1.1.0/node_modules/math-intrinsics/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "media-typer@1.1.1", "Name": "media-typer", "Identifier": { "PURL": "pkg:npm/media-typer@1.1.1", "UID": "1bae6249427c807e" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/media-typer@1.1.1/node_modules/media-typer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "merge-descriptors@2.0.0", "Name": "merge-descriptors", "Identifier": { "PURL": "pkg:npm/merge-descriptors@2.0.0", "UID": "355e222ad49608b6" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/merge-descriptors@2.0.0/node_modules/merge-descriptors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mime-db@1.54.0", "Name": "mime-db", "Identifier": { "PURL": "pkg:npm/mime-db@1.54.0", "UID": "d2063514dc423593" }, "Version": "1.54.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/mime-db@1.54.0/node_modules/mime-db/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mime-types@3.0.2", "Name": "mime-types", "Identifier": { "PURL": "pkg:npm/mime-types@3.0.2", "UID": "a6d74f26b87c7a5c" }, "Version": "3.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/mime-types@3.0.2/node_modules/mime-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "minimatch@10.2.5", "Name": "minimatch", "Identifier": { "PURL": "pkg:npm/minimatch@10.2.5", "UID": "f3fb44efa3c3f92" }, "Version": "10.2.5", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/minimatch@10.2.5/node_modules/minimatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "minimatch@5.1.9", "Name": "minimatch", "Identifier": { "PURL": "pkg:npm/minimatch@5.1.9", "UID": "5747fc61850a61fe" }, "Version": "5.1.9", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/minimatch@5.1.9/node_modules/minimatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "minimatch@9.0.9", "Name": "minimatch", "Identifier": { "PURL": "pkg:npm/minimatch@9.0.9", "UID": "a5bfc606792d3927" }, "Version": "9.0.9", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/minimatch@9.0.9/node_modules/minimatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "minipass@7.1.3", "Name": "minipass", "Identifier": { "PURL": "pkg:npm/minipass@7.1.3", "UID": "2c4063679d012529" }, "Version": "7.1.3", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/minipass@7.1.3/node_modules/minipass/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "minizlib@3.1.0", "Name": "minizlib", "Identifier": { "PURL": "pkg:npm/minizlib@3.1.0", "UID": "c1b430d902b84df5" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/minizlib@3.1.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mkdirp@3.0.1", "Name": "mkdirp", "Identifier": { "PURL": "pkg:npm/mkdirp@3.0.1", "UID": "f6ca0e34f5874d8" }, "Version": "3.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/mkdirp@3.0.1/node_modules/mkdirp/dist/cjs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mkdirp@3.0.1", "Name": "mkdirp", "Identifier": { "PURL": "pkg:npm/mkdirp@3.0.1", "UID": "bb0561f52abb1db9" }, "Version": "3.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/mkdirp@3.0.1/node_modules/mkdirp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mkdirp-classic@0.5.3", "Name": "mkdirp-classic", "Identifier": { "PURL": "pkg:npm/mkdirp-classic@0.5.3", "UID": "69ad5248da27c88a" }, "Version": "0.5.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/mkdirp-classic@0.5.3/node_modules/mkdirp-classic/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "module-details-from-path@1.0.4", "Name": "module-details-from-path", "Identifier": { "PURL": "pkg:npm/module-details-from-path@1.0.4", "UID": "a8fb66dd5eff4371" }, "Version": "1.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/module-details-from-path@1.0.4/node_modules/module-details-from-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.1.3", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.1.3", "UID": "29ea4b2c350e551c" }, "Version": "2.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ms@2.1.3/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "msgpackr@1.11.5", "Name": "msgpackr", "Identifier": { "PURL": "pkg:npm/msgpackr@1.11.5", "UID": "33be5b082c770146" }, "Version": "1.11.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/msgpackr@1.11.5/node_modules/msgpackr/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "msgpackr-extract@3.0.3", "Name": "msgpackr-extract", "Identifier": { "PURL": "pkg:npm/msgpackr-extract@3.0.3", "UID": "75b054b681ac2426" }, "Version": "3.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/msgpackr-extract@3.0.3/node_modules/msgpackr-extract/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nan@2.26.2", "Name": "nan", "Identifier": { "PURL": "pkg:npm/nan@2.26.2", "UID": "860698f4ed67b063" }, "Version": "2.26.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/nan@2.26.2/node_modules/nan/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nanoid@3.3.11", "Name": "nanoid", "Identifier": { "PURL": "pkg:npm/nanoid@3.3.11", "UID": "633d201c33d4c6a4" }, "Version": "3.3.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/nanoid@3.3.11/node_modules/nanoid/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nanostores@1.2.0", "Name": "nanostores", "Identifier": { "PURL": "pkg:npm/nanostores@1.2.0", "UID": "7d141772046fb743" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/nanostores@1.2.0/node_modules/nanostores/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "negotiator@1.0.0", "Name": "negotiator", "Identifier": { "PURL": "pkg:npm/negotiator@1.0.0", "UID": "619cb26b43b44c29" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/negotiator@1.0.0/node_modules/negotiator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "node-abort-controller@3.1.1", "Name": "node-abort-controller", "Identifier": { "PURL": "pkg:npm/node-abort-controller@3.1.1", "UID": "d40013330086594e" }, "Version": "3.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/node-abort-controller@3.1.1/node_modules/node-abort-controller/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "node-gyp@13.0.1", "Name": "node-gyp", "Identifier": { "PURL": "pkg:npm/node-gyp@13.0.1", "UID": "d27c22af7848f3e8" }, "Version": "13.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/node-gyp@13.0.1@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "node-gyp-build-optional-packages@5.2.2", "Name": "node-gyp-build-optional-packages", "Identifier": { "PURL": "pkg:npm/node-gyp-build-optional-packages@5.2.2", "UID": "965f69584d30eff7" }, "Version": "5.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/node-gyp-build-optional-packages@5.2.2/node_modules/node-gyp-build-optional-packages/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "node-releases@2.0.36", "Name": "node-releases", "Identifier": { "PURL": "pkg:npm/node-releases@2.0.36", "UID": "9fbba138149e3391" }, "Version": "2.0.36", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/node-releases@2.0.36/node_modules/node-releases/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nodemailer@6.10.1", "Name": "nodemailer", "Identifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "Version": "6.10.1", "Licenses": [ "MIT-0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nopt@10.0.1", "Name": "nopt", "Identifier": { "PURL": "pkg:npm/nopt@10.0.1", "UID": "84487a2adebf76c6" }, "Version": "10.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/nopt@10.0.1@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "normalize-path@3.0.0", "Name": "normalize-path", "Identifier": { "PURL": "pkg:npm/normalize-path@3.0.0", "UID": "76c02a2e815cdc45" }, "Version": "3.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/normalize-path@3.0.0/node_modules/normalize-path/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "object-assign@4.1.1", "Name": "object-assign", "Identifier": { "PURL": "pkg:npm/object-assign@4.1.1", "UID": "79ddc9dacc70683" }, "Version": "4.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/object-assign@4.1.1/node_modules/object-assign/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "object-inspect@1.13.4", "Name": "object-inspect", "Identifier": { "PURL": "pkg:npm/object-inspect@1.13.4", "UID": "66cf91bf4d9249ff" }, "Version": "1.13.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/object-inspect@1.13.4/node_modules/object-inspect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "obug@2.1.1", "Name": "obug", "Identifier": { "PURL": "pkg:npm/obug@2.1.1", "UID": "b0cf7873d534b1e6" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/obug@2.1.1/node_modules/obug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "on-finished@2.4.1", "Name": "on-finished", "Identifier": { "PURL": "pkg:npm/on-finished@2.4.1", "UID": "3a0ff42c747adadc" }, "Version": "2.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/on-finished@2.4.1/node_modules/on-finished/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "once@1.4.0", "Name": "once", "Identifier": { "PURL": "pkg:npm/once@1.4.0", "UID": "608a93086f9382b6" }, "Version": "1.4.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/once@1.4.0/node_modules/once/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "orderedmap@2.1.1", "Name": "orderedmap", "Identifier": { "PURL": "pkg:npm/orderedmap@2.1.1", "UID": "7b083b33e06bbfaa" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/orderedmap@2.1.1/node_modules/orderedmap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "p-limit@2.3.0", "Name": "p-limit", "Identifier": { "PURL": "pkg:npm/p-limit@2.3.0", "UID": "8637f79cb5615018" }, "Version": "2.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/p-limit@2.3.0/node_modules/p-limit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "p-locate@4.1.0", "Name": "p-locate", "Identifier": { "PURL": "pkg:npm/p-locate@4.1.0", "UID": "de4228d58408beef" }, "Version": "4.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/p-locate@4.1.0/node_modules/p-locate/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "p-try@2.2.0", "Name": "p-try", "Identifier": { "PURL": "pkg:npm/p-try@2.2.0", "UID": "c1113dddff2a8ba" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/p-try@2.2.0/node_modules/p-try/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "package-json-from-dist@1.0.1", "Name": "package-json-from-dist", "Identifier": { "PURL": "pkg:npm/package-json-from-dist@1.0.1", "UID": "57410c69a8f6f923" }, "Version": "1.0.1", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/package-json-from-dist@1.0.1/node_modules/package-json-from-dist/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "parseurl@1.3.3", "Name": "parseurl", "Identifier": { "PURL": "pkg:npm/parseurl@1.3.3", "UID": "64352c497f26debb" }, "Version": "1.3.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/parseurl@1.3.3/node_modules/parseurl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "path-exists@4.0.0", "Name": "path-exists", "Identifier": { "PURL": "pkg:npm/path-exists@4.0.0", "UID": "3548f56ab4d4037" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/path-exists@4.0.0/node_modules/path-exists/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "path-key@3.1.1", "Name": "path-key", "Identifier": { "PURL": "pkg:npm/path-key@3.1.1", "UID": "a216c5d4496663ea" }, "Version": "3.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/path-key@3.1.1/node_modules/path-key/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "path-scurry@1.11.1", "Name": "path-scurry", "Identifier": { "PURL": "pkg:npm/path-scurry@1.11.1", "UID": "676f91b24b3a34d7" }, "Version": "1.11.1", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/path-scurry@1.11.1/node_modules/path-scurry/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "path-to-regexp@8.4.2", "Name": "path-to-regexp", "Identifier": { "PURL": "pkg:npm/path-to-regexp@8.4.2", "UID": "74129b4f55cc1b99" }, "Version": "8.4.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/path-to-regexp@8.4.2/node_modules/path-to-regexp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pathe@2.0.3", "Name": "pathe", "Identifier": { "PURL": "pkg:npm/pathe@2.0.3", "UID": "6804a88787b1307e" }, "Version": "2.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pathe@2.0.3/node_modules/pathe/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg@8.20.0", "Name": "pg", "Identifier": { "PURL": "pkg:npm/pg@8.20.0", "UID": "626b4deed4b31065" }, "Version": "8.20.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg@8.20.0+52bd52a0bccfa6a2/node_modules/pg/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-cloudflare@1.3.0", "Name": "pg-cloudflare", "Identifier": { "PURL": "pkg:npm/pg-cloudflare@1.3.0", "UID": "74c8a80ec8513842" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-cloudflare@1.3.0/node_modules/pg-cloudflare/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-connection-string@2.12.0", "Name": "pg-connection-string", "Identifier": { "PURL": "pkg:npm/pg-connection-string@2.12.0", "UID": "517efe2f590aa2a9" }, "Version": "2.12.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-connection-string@2.12.0/node_modules/pg-connection-string/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-int8@1.0.1", "Name": "pg-int8", "Identifier": { "PURL": "pkg:npm/pg-int8@1.0.1", "UID": "ed94737e1da72ee5" }, "Version": "1.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-int8@1.0.1/node_modules/pg-int8/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-pool@3.13.0", "Name": "pg-pool", "Identifier": { "PURL": "pkg:npm/pg-pool@3.13.0", "UID": "a09c134cbc69c412" }, "Version": "3.13.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-pool@3.13.0+52bd52a0bccfa6a2/node_modules/pg-pool/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-protocol@1.13.0", "Name": "pg-protocol", "Identifier": { "PURL": "pkg:npm/pg-protocol@1.13.0", "UID": "d86d634ce1d33331" }, "Version": "1.13.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-protocol@1.13.0/node_modules/pg-protocol/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-types@2.2.0", "Name": "pg-types", "Identifier": { "PURL": "pkg:npm/pg-types@2.2.0", "UID": "d1a5e287945b31f5" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pg-types@2.2.0/node_modules/pg-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pgpass@1.0.5", "Name": "pgpass", "Identifier": { "PURL": "pkg:npm/pgpass@1.0.5", "UID": "affb541c68fa304a" }, "Version": "1.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pgpass@1.0.5/node_modules/pgpass/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "picocolors@1.1.1", "Name": "picocolors", "Identifier": { "PURL": "pkg:npm/picocolors@1.1.1", "UID": "812a89a902eebeb" }, "Version": "1.1.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/picocolors@1.1.1/node_modules/picocolors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "picomatch@2.3.1", "Name": "picomatch", "Identifier": { "PURL": "pkg:npm/picomatch@2.3.1", "UID": "38b6bd8a897b645a" }, "Version": "2.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/picomatch@2.3.1/node_modules/picomatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "picomatch@4.0.3", "Name": "picomatch", "Identifier": { "PURL": "pkg:npm/picomatch@4.0.3", "UID": "3e9097194133d28d" }, "Version": "4.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/picomatch@4.0.3/node_modules/picomatch/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "picomatch@4.0.5", "Name": "picomatch", "Identifier": { "PURL": "pkg:npm/picomatch@4.0.5", "UID": "186e82c15f4787c2" }, "Version": "4.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/picomatch@4.0.5@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pkce-challenge@5.0.1", "Name": "pkce-challenge", "Identifier": { "PURL": "pkg:npm/pkce-challenge@5.0.1", "UID": "84eef3350434f918" }, "Version": "5.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pkce-challenge@5.0.1/node_modules/pkce-challenge/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "playwright@1.58.2", "Name": "playwright", "Identifier": { "PURL": "pkg:npm/playwright@1.58.2", "UID": "e9930c7139decedf" }, "Version": "1.58.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/playwright@1.58.2/node_modules/playwright/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "playwright-core@1.58.2", "Name": "playwright-core", "Identifier": { "PURL": "pkg:npm/playwright-core@1.58.2", "UID": "1163118a533bcbbf" }, "Version": "1.58.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/playwright-core@1.58.2/node_modules/playwright-core/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pngjs@5.0.0", "Name": "pngjs", "Identifier": { "PURL": "pkg:npm/pngjs@5.0.0", "UID": "6a46e79aa6ede829" }, "Version": "5.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pngjs@5.0.0/node_modules/pngjs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postcss@8.5.8", "Name": "postcss", "Identifier": { "PURL": "pkg:npm/postcss@8.5.8", "UID": "7698fa5f82038eff" }, "Version": "8.5.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/postcss@8.5.8/node_modules/postcss/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-array@2.0.0", "Name": "postgres-array", "Identifier": { "PURL": "pkg:npm/postgres-array@2.0.0", "UID": "6515afa006169ac1" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/postgres-array@2.0.0/node_modules/postgres-array/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-bytea@1.0.1", "Name": "postgres-bytea", "Identifier": { "PURL": "pkg:npm/postgres-bytea@1.0.1", "UID": "c9b860048f029ff3" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/postgres-bytea@1.0.1/node_modules/postgres-bytea/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-date@1.0.7", "Name": "postgres-date", "Identifier": { "PURL": "pkg:npm/postgres-date@1.0.7", "UID": "e753bc01be80554d" }, "Version": "1.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/postgres-date@1.0.7/node_modules/postgres-date/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-interval@1.2.0", "Name": "postgres-interval", "Identifier": { "PURL": "pkg:npm/postgres-interval@1.2.0", "UID": "2c12db5082765cce" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/postgres-interval@1.2.0/node_modules/postgres-interval/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prettier@3.8.1", "Name": "prettier", "Identifier": { "PURL": "pkg:npm/prettier@3.8.1", "UID": "9b45f935f47ccea1" }, "Version": "3.8.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prettier@3.8.1/node_modules/prettier/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "proc-log@7.0.0", "Name": "proc-log", "Identifier": { "PURL": "pkg:npm/proc-log@7.0.0", "UID": "e2ff36ddfff30c76" }, "Version": "7.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/proc-log@7.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "process@0.11.10", "Name": "process", "Identifier": { "PURL": "pkg:npm/process@0.11.10", "UID": "57be9ce14a7bb3a1" }, "Version": "0.11.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/process@0.11.10/node_modules/process/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "process-nextick-args@2.0.1", "Name": "process-nextick-args", "Identifier": { "PURL": "pkg:npm/process-nextick-args@2.0.1", "UID": "9eb9d739f982cd66" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/process-nextick-args@2.0.1/node_modules/process-nextick-args/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "proper-lockfile@4.1.2", "Name": "proper-lockfile", "Identifier": { "PURL": "pkg:npm/proper-lockfile@4.1.2", "UID": "c28ee8a32fa198c4" }, "Version": "4.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "properties-reader@3.0.1", "Name": "properties-reader", "Identifier": { "PURL": "pkg:npm/properties-reader@3.0.1", "UID": "3e95bc6e3299e221" }, "Version": "3.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/properties-reader@3.0.1/node_modules/properties-reader/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-changeset@2.4.1", "Name": "prosemirror-changeset", "Identifier": { "PURL": "pkg:npm/prosemirror-changeset@2.4.1", "UID": "8e881c730e576701" }, "Version": "2.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-changeset@2.4.1/node_modules/prosemirror-changeset/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-commands@1.7.1", "Name": "prosemirror-commands", "Identifier": { "PURL": "pkg:npm/prosemirror-commands@1.7.1", "UID": "e06dc3bcd48ef522" }, "Version": "1.7.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-commands@1.7.1/node_modules/prosemirror-commands/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-dropcursor@1.8.3", "Name": "prosemirror-dropcursor", "Identifier": { "PURL": "pkg:npm/prosemirror-dropcursor@1.8.3", "UID": "fbaa20622eddc802" }, "Version": "1.8.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-dropcursor@1.8.3/node_modules/prosemirror-dropcursor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-gapcursor@1.4.1", "Name": "prosemirror-gapcursor", "Identifier": { "PURL": "pkg:npm/prosemirror-gapcursor@1.4.1", "UID": "ff2c797d6bf201f8" }, "Version": "1.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-gapcursor@1.4.1/node_modules/prosemirror-gapcursor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-history@1.5.0", "Name": "prosemirror-history", "Identifier": { "PURL": "pkg:npm/prosemirror-history@1.5.0", "UID": "f4a89c1133c431d3" }, "Version": "1.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-history@1.5.0/node_modules/prosemirror-history/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-inputrules@1.5.1", "Name": "prosemirror-inputrules", "Identifier": { "PURL": "pkg:npm/prosemirror-inputrules@1.5.1", "UID": "3eaf7c8e16b47084" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-inputrules@1.5.1/node_modules/prosemirror-inputrules/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-keymap@1.2.3", "Name": "prosemirror-keymap", "Identifier": { "PURL": "pkg:npm/prosemirror-keymap@1.2.3", "UID": "25fbfc8f6fdaf091" }, "Version": "1.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-keymap@1.2.3/node_modules/prosemirror-keymap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-model@1.25.11", "Name": "prosemirror-model", "Identifier": { "PURL": "pkg:npm/prosemirror-model@1.25.11", "UID": "82fb7dcc936979ac" }, "Version": "1.25.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-model@1.25.11/node_modules/prosemirror-model/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-schema-list@1.5.1", "Name": "prosemirror-schema-list", "Identifier": { "PURL": "pkg:npm/prosemirror-schema-list@1.5.1", "UID": "9018929d76e7c65b" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-schema-list@1.5.1/node_modules/prosemirror-schema-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-state@1.4.4", "Name": "prosemirror-state", "Identifier": { "PURL": "pkg:npm/prosemirror-state@1.4.4", "UID": "9842732adefba424" }, "Version": "1.4.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-state@1.4.4/node_modules/prosemirror-state/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-tables@1.8.5", "Name": "prosemirror-tables", "Identifier": { "PURL": "pkg:npm/prosemirror-tables@1.8.5", "UID": "cbf7ecfcaca14775" }, "Version": "1.8.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-tables@1.8.5/node_modules/prosemirror-tables/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-transform@1.12.0", "Name": "prosemirror-transform", "Identifier": { "PURL": "pkg:npm/prosemirror-transform@1.12.0", "UID": "896d4ebe7642cfe9" }, "Version": "1.12.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-transform@1.12.0/node_modules/prosemirror-transform/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "prosemirror-view@1.42.2", "Name": "prosemirror-view", "Identifier": { "PURL": "pkg:npm/prosemirror-view@1.42.2", "UID": "ada21626476c2729" }, "Version": "1.42.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/prosemirror-view@1.42.2/node_modules/prosemirror-view/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "protobufjs@7.5.5", "Name": "protobufjs", "Identifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "Version": "7.5.5", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "proxy-addr@2.0.7", "Name": "proxy-addr", "Identifier": { "PURL": "pkg:npm/proxy-addr@2.0.7", "UID": "65cdc6facf143eb3" }, "Version": "2.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/proxy-addr@2.0.7/node_modules/proxy-addr/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pump@3.0.4", "Name": "pump", "Identifier": { "PURL": "pkg:npm/pump@3.0.4", "UID": "bc57b3a61579d514" }, "Version": "3.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/pump@3.0.4/node_modules/pump/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "qrcode@1.5.4", "Name": "qrcode", "Identifier": { "PURL": "pkg:npm/qrcode@1.5.4", "UID": "519ce4e6cc8769a" }, "Version": "1.5.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/qrcode@1.5.4/node_modules/qrcode/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "qs@6.15.3", "Name": "qs", "Identifier": { "PURL": "pkg:npm/qs@6.15.3", "UID": "70f94f866c53d2bb" }, "Version": "6.15.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/qs@6.15.3/node_modules/qs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "range-parser@1.3.0", "Name": "range-parser", "Identifier": { "PURL": "pkg:npm/range-parser@1.3.0", "UID": "63d8e0aae634354e" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/range-parser@1.3.0/node_modules/range-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "raw-body@3.0.2", "Name": "raw-body", "Identifier": { "PURL": "pkg:npm/raw-body@3.0.2", "UID": "4a8498b99a985b87" }, "Version": "3.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/raw-body@3.0.2/node_modules/raw-body/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react@19.2.4", "Name": "react", "Identifier": { "PURL": "pkg:npm/react@19.2.4", "UID": "cf814f131de88c44" }, "Version": "19.2.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react@19.2.4/node_modules/react/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-dom@19.2.4", "Name": "react-dom", "Identifier": { "PURL": "pkg:npm/react-dom@19.2.4", "UID": "20d5cfaa23b3150f" }, "Version": "19.2.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-dom@19.2.4+b1ab299f0a400331/node_modules/react-dom/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-hook-form@7.72.0", "Name": "react-hook-form", "Identifier": { "PURL": "pkg:npm/react-hook-form@7.72.0", "UID": "f67f1be02dcf180b" }, "Version": "7.72.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-hook-form@7.72.0+b1ab299f0a400331/node_modules/react-hook-form/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-is@19.2.5", "Name": "react-is", "Identifier": { "PURL": "pkg:npm/react-is@19.2.5", "UID": "4d9dada8750e4b8d" }, "Version": "19.2.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-is@19.2.5/node_modules/react-is/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-redux@9.2.0", "Name": "react-redux", "Identifier": { "PURL": "pkg:npm/react-redux@9.2.0", "UID": "ad882c897878567e" }, "Version": "9.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-redux@9.2.0+d670770d2e097c1e/node_modules/react-redux/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-refresh@0.18.0", "Name": "react-refresh", "Identifier": { "PURL": "pkg:npm/react-refresh@0.18.0", "UID": "d215873379f2fc58" }, "Version": "0.18.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-refresh@0.18.0/node_modules/react-refresh/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-remove-scroll@2.7.2", "Name": "react-remove-scroll", "Identifier": { "PURL": "pkg:npm/react-remove-scroll@2.7.2", "UID": "a39cb6f13b430313" }, "Version": "2.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-remove-scroll@2.7.2+26a211c426f3f87c/node_modules/react-remove-scroll/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-remove-scroll-bar@2.3.8", "Name": "react-remove-scroll-bar", "Identifier": { "PURL": "pkg:npm/react-remove-scroll-bar@2.3.8", "UID": "797a824b3ee2b463" }, "Version": "2.3.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-remove-scroll-bar@2.3.8+26a211c426f3f87c/node_modules/react-remove-scroll-bar/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "react-style-singleton@2.2.3", "Name": "react-style-singleton", "Identifier": { "PURL": "pkg:npm/react-style-singleton@2.2.3", "UID": "6ac9263b10e1a7a1" }, "Version": "2.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/react-style-singleton@2.2.3+26a211c426f3f87c/node_modules/react-style-singleton/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "readable-stream@2.3.8", "Name": "readable-stream", "Identifier": { "PURL": "pkg:npm/readable-stream@2.3.8", "UID": "594407b78a47df35" }, "Version": "2.3.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/readable-stream@2.3.8/node_modules/readable-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "readable-stream@3.6.2", "Name": "readable-stream", "Identifier": { "PURL": "pkg:npm/readable-stream@3.6.2", "UID": "ab3fb16e5da04794" }, "Version": "3.6.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/readable-stream@3.6.2/node_modules/readable-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "readable-stream@4.7.0", "Name": "readable-stream", "Identifier": { "PURL": "pkg:npm/readable-stream@4.7.0", "UID": "91513ccbd051fece" }, "Version": "4.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/readable-stream@4.7.0/node_modules/readable-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "readdir-glob@1.1.3", "Name": "readdir-glob", "Identifier": { "PURL": "pkg:npm/readdir-glob@1.1.3", "UID": "fb3dfa7f7b3dae36" }, "Version": "1.1.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/readdir-glob@1.1.3/node_modules/readdir-glob/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "readdirp@3.6.0", "Name": "readdirp", "Identifier": { "PURL": "pkg:npm/readdirp@3.6.0", "UID": "60dcee530581cfab" }, "Version": "3.6.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/readdirp@3.6.0/node_modules/readdirp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "recast@0.23.11", "Name": "recast", "Identifier": { "PURL": "pkg:npm/recast@0.23.11", "UID": "2e005dca4de5dfe7" }, "Version": "0.23.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/recast@0.23.11/node_modules/recast/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "recharts@3.8.1", "Name": "recharts", "Identifier": { "PURL": "pkg:npm/recharts@3.8.1", "UID": "111f8507938d46bf" }, "Version": "3.8.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/recharts@3.8.1+687ec14e1ae8cbfc/node_modules/recharts/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "redis-errors@1.2.0", "Name": "redis-errors", "Identifier": { "PURL": "pkg:npm/redis-errors@1.2.0", "UID": "e06f3ee29bab5bc6" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/redis-errors@1.2.0/node_modules/redis-errors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "redis-parser@3.0.0", "Name": "redis-parser", "Identifier": { "PURL": "pkg:npm/redis-parser@3.0.0", "UID": "4c6d5e4b30250740" }, "Version": "3.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/redis-parser@3.0.0/node_modules/redis-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "redux@5.0.1", "Name": "redux", "Identifier": { "PURL": "pkg:npm/redux@5.0.1", "UID": "122029272b42b680" }, "Version": "5.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/redux@5.0.1/node_modules/redux/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "redux-thunk@3.1.0", "Name": "redux-thunk", "Identifier": { "PURL": "pkg:npm/redux-thunk@3.1.0", "UID": "86d9aca76f17e58f" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/redux-thunk@3.1.0+bc2e82c311c56ef9/node_modules/redux-thunk/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "require-directory@2.1.1", "Name": "require-directory", "Identifier": { "PURL": "pkg:npm/require-directory@2.1.1", "UID": "3d6371afda81463f" }, "Version": "2.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/require-directory@2.1.1/node_modules/require-directory/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "require-from-string@2.0.2", "Name": "require-from-string", "Identifier": { "PURL": "pkg:npm/require-from-string@2.0.2", "UID": "6a20553a4368f253" }, "Version": "2.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/require-from-string@2.0.2/node_modules/require-from-string/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "require-in-the-middle@8.0.1", "Name": "require-in-the-middle", "Identifier": { "PURL": "pkg:npm/require-in-the-middle@8.0.1", "UID": "51c38b6c12008bf8" }, "Version": "8.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/require-in-the-middle@8.0.1/node_modules/require-in-the-middle/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "require-main-filename@2.0.0", "Name": "require-main-filename", "Identifier": { "PURL": "pkg:npm/require-main-filename@2.0.0", "UID": "882811037a3b0dad" }, "Version": "2.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/require-main-filename@2.0.0/node_modules/require-main-filename/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "reselect@5.1.1", "Name": "reselect", "Identifier": { "PURL": "pkg:npm/reselect@5.1.1", "UID": "b4a12da2f1d97fa9" }, "Version": "5.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/reselect@5.1.1/node_modules/reselect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "resolve-pkg-maps@1.0.0", "Name": "resolve-pkg-maps", "Identifier": { "PURL": "pkg:npm/resolve-pkg-maps@1.0.0", "UID": "c2486356378616db" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/resolve-pkg-maps@1.0.0/node_modules/resolve-pkg-maps/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "retry@0.12.0", "Name": "retry", "Identifier": { "PURL": "pkg:npm/retry@0.12.0", "UID": "b33710c3a17726fa" }, "Version": "0.12.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/retry@0.12.0/node_modules/retry/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "rolldown@1.0.0-rc.10", "Name": "rolldown", "Identifier": { "PURL": "pkg:npm/rolldown@1.0.0-rc.10", "UID": "f6977f2c5b287946" }, "Version": "1.0.0-rc.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/rolldown@1.0.0-rc.10/node_modules/rolldown/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "rollup@4.60.0", "Name": "rollup", "Identifier": { "PURL": "pkg:npm/rollup@4.60.0", "UID": "e7c34e77a3c095c0" }, "Version": "4.60.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/rollup@4.60.0/node_modules/rollup/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "rope-sequence@1.3.4", "Name": "rope-sequence", "Identifier": { "PURL": "pkg:npm/rope-sequence@1.3.4", "UID": "48b371109d011863" }, "Version": "1.3.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/rope-sequence@1.3.4/node_modules/rope-sequence/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "rou3@0.7.12", "Name": "rou3", "Identifier": { "PURL": "pkg:npm/rou3@0.7.12", "UID": "a678c97e9edcb011" }, "Version": "0.7.12", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/rou3@0.7.12/node_modules/rou3/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "router@2.2.0", "Name": "router", "Identifier": { "PURL": "pkg:npm/router@2.2.0", "UID": "3d13466fd10a330d" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/router@2.2.0/node_modules/router/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "safe-buffer@5.1.2", "Name": "safe-buffer", "Identifier": { "PURL": "pkg:npm/safe-buffer@5.1.2", "UID": "b8a4d753b8a2d75e" }, "Version": "5.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/safe-buffer@5.1.2/node_modules/safe-buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "safe-buffer@5.2.1", "Name": "safe-buffer", "Identifier": { "PURL": "pkg:npm/safe-buffer@5.2.1", "UID": "b519dcc1c0b5205d" }, "Version": "5.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/safe-buffer@5.2.1/node_modules/safe-buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "safer-buffer@2.1.2", "Name": "safer-buffer", "Identifier": { "PURL": "pkg:npm/safer-buffer@2.1.2", "UID": "ef13595f484d435c" }, "Version": "2.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/safer-buffer@2.1.2/node_modules/safer-buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "scheduler@0.27.0", "Name": "scheduler", "Identifier": { "PURL": "pkg:npm/scheduler@0.27.0", "UID": "2fdb3d1ae67e95db" }, "Version": "0.27.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/scheduler@0.27.0/node_modules/scheduler/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "semver@6.3.1", "Name": "semver", "Identifier": { "PURL": "pkg:npm/semver@6.3.1", "UID": "ce17c3d91dcefc16" }, "Version": "6.3.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/semver@6.3.1/node_modules/semver/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "semver@7.7.4", "Name": "semver", "Identifier": { "PURL": "pkg:npm/semver@7.7.4", "UID": "330d6318f27f427f" }, "Version": "7.7.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/semver@7.7.4/node_modules/semver/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "semver@7.8.5", "Name": "semver", "Identifier": { "PURL": "pkg:npm/semver@7.8.5", "UID": "4ba9867f6ee26791" }, "Version": "7.8.5", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/semver@7.8.5@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "send@1.2.1", "Name": "send", "Identifier": { "PURL": "pkg:npm/send@1.2.1", "UID": "1cb310590c2b9c8a" }, "Version": "1.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/send@1.2.1/node_modules/send/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "seroval@1.5.1", "Name": "seroval", "Identifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "seroval-plugins@1.5.1", "Name": "seroval-plugins", "Identifier": { "PURL": "pkg:npm/seroval-plugins@1.5.1", "UID": "4bd7deafd7a60a2f" }, "Version": "1.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/seroval-plugins@1.5.1+874c7b8e1fe073e0/node_modules/seroval-plugins/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "serve-static@2.2.1", "Name": "serve-static", "Identifier": { "PURL": "pkg:npm/serve-static@2.2.1", "UID": "edc665976f1f21b4" }, "Version": "2.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/serve-static@2.2.1/node_modules/serve-static/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "set-blocking@2.0.0", "Name": "set-blocking", "Identifier": { "PURL": "pkg:npm/set-blocking@2.0.0", "UID": "fbddc68a98d7f297" }, "Version": "2.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/set-blocking@2.0.0/node_modules/set-blocking/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "set-cookie-parser@3.1.0", "Name": "set-cookie-parser", "Identifier": { "PURL": "pkg:npm/set-cookie-parser@3.1.0", "UID": "28c5143089c1103b" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/set-cookie-parser@3.1.0/node_modules/set-cookie-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "setprototypeof@1.2.0", "Name": "setprototypeof", "Identifier": { "PURL": "pkg:npm/setprototypeof@1.2.0", "UID": "f83d8ef56315327f" }, "Version": "1.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/setprototypeof@1.2.0/node_modules/setprototypeof/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "shebang-command@2.0.0", "Name": "shebang-command", "Identifier": { "PURL": "pkg:npm/shebang-command@2.0.0", "UID": "7f2086e9c9a83f54" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/shebang-command@2.0.0/node_modules/shebang-command/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "shebang-regex@3.0.0", "Name": "shebang-regex", "Identifier": { "PURL": "pkg:npm/shebang-regex@3.0.0", "UID": "8aad0185bb04d07f" }, "Version": "3.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/shebang-regex@3.0.0/node_modules/shebang-regex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel@1.1.1", "Name": "side-channel", "Identifier": { "PURL": "pkg:npm/side-channel@1.1.1", "UID": "fa6af48fb4189f8" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/side-channel@1.1.1/node_modules/side-channel/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-list@1.0.1", "Name": "side-channel-list", "Identifier": { "PURL": "pkg:npm/side-channel-list@1.0.1", "UID": "61c7472c88dcb4ff" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/side-channel-list@1.0.1/node_modules/side-channel-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-map@1.0.1", "Name": "side-channel-map", "Identifier": { "PURL": "pkg:npm/side-channel-map@1.0.1", "UID": "5fcc2fb9865d35f0" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/side-channel-map@1.0.1/node_modules/side-channel-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-weakmap@1.0.2", "Name": "side-channel-weakmap", "Identifier": { "PURL": "pkg:npm/side-channel-weakmap@1.0.2", "UID": "71d4b9969d9da60e" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/side-channel-weakmap@1.0.2/node_modules/side-channel-weakmap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "siginfo@2.0.0", "Name": "siginfo", "Identifier": { "PURL": "pkg:npm/siginfo@2.0.0", "UID": "f1a7424de459b571" }, "Version": "2.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/siginfo@2.0.0/node_modules/siginfo/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "signal-exit@3.0.7", "Name": "signal-exit", "Identifier": { "PURL": "pkg:npm/signal-exit@3.0.7", "UID": "dce921dc852c9ec0" }, "Version": "3.0.7", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "signal-exit@4.1.0", "Name": "signal-exit", "Identifier": { "PURL": "pkg:npm/signal-exit@4.1.0", "UID": "7e3b49291a9b40e4" }, "Version": "4.1.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/signal-exit@4.1.0/node_modules/signal-exit/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "sonner@2.0.7", "Name": "sonner", "Identifier": { "PURL": "pkg:npm/sonner@2.0.7", "UID": "2b1ac7c821deeacc" }, "Version": "2.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/sonner@2.0.7+bf16f8eded5e12ee/node_modules/sonner/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "source-map@0.6.1", "Name": "source-map", "Identifier": { "PURL": "pkg:npm/source-map@0.6.1", "UID": "ae1a5d2f311825bb" }, "Version": "0.6.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/source-map@0.6.1/node_modules/source-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "source-map@0.7.6", "Name": "source-map", "Identifier": { "PURL": "pkg:npm/source-map@0.7.6", "UID": "2f97c21ef5cb32a" }, "Version": "0.7.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/source-map@0.7.6/node_modules/source-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "source-map-js@1.2.1", "Name": "source-map-js", "Identifier": { "PURL": "pkg:npm/source-map-js@1.2.1", "UID": "c52b62c3fb132e01" }, "Version": "1.2.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/source-map-js@1.2.1/node_modules/source-map-js/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "source-map-support@0.5.21", "Name": "source-map-support", "Identifier": { "PURL": "pkg:npm/source-map-support@0.5.21", "UID": "be4c13863ab394ac" }, "Version": "0.5.21", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/source-map-support@0.5.21/node_modules/source-map-support/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "split-ca@1.0.1", "Name": "split-ca", "Identifier": { "PURL": "pkg:npm/split-ca@1.0.1", "UID": "537ac2875ac7e0" }, "Version": "1.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/split-ca@1.0.1/node_modules/split-ca/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "split2@4.2.0", "Name": "split2", "Identifier": { "PURL": "pkg:npm/split2@4.2.0", "UID": "cd933fea0be7076a" }, "Version": "4.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/split2@4.2.0/node_modules/split2/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ssh-remote-port-forward@1.0.4", "Name": "ssh-remote-port-forward", "Identifier": { "PURL": "pkg:npm/ssh-remote-port-forward@1.0.4", "UID": "532812a20c030148" }, "Version": "1.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ssh-remote-port-forward@1.0.4/node_modules/ssh-remote-port-forward/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ssh2@1.17.0", "Name": "ssh2", "Identifier": { "PURL": "pkg:npm/ssh2@1.17.0", "UID": "efa68c1d34502c39" }, "Version": "1.17.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/ssh2@1.17.0/node_modules/ssh2/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "stackback@0.0.2", "Name": "stackback", "Identifier": { "PURL": "pkg:npm/stackback@0.0.2", "UID": "fc0d9ae049406c2c" }, "Version": "0.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/stackback@0.0.2/node_modules/stackback/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "standard-as-callback@2.1.0", "Name": "standard-as-callback", "Identifier": { "PURL": "pkg:npm/standard-as-callback@2.1.0", "UID": "f70d87fb8aa39d73" }, "Version": "2.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/standard-as-callback@2.1.0/node_modules/standard-as-callback/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "statuses@2.0.2", "Name": "statuses", "Identifier": { "PURL": "pkg:npm/statuses@2.0.2", "UID": "799fd6272a0c3134" }, "Version": "2.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/statuses@2.0.2/node_modules/statuses/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "std-env@4.0.0", "Name": "std-env", "Identifier": { "PURL": "pkg:npm/std-env@4.0.0", "UID": "9cc230157451e32" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/std-env@4.0.0/node_modules/std-env/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "streamx@2.25.0", "Name": "streamx", "Identifier": { "PURL": "pkg:npm/streamx@2.25.0", "UID": "dffe392b09dd7979" }, "Version": "2.25.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/streamx@2.25.0/node_modules/streamx/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "string-width@4.2.3", "Name": "string-width", "Identifier": { "PURL": "pkg:npm/string-width@4.2.3", "UID": "709cbd7056088006" }, "Version": "4.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/string-width@4.2.3/node_modules/string-width/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "string-width@5.1.2", "Name": "string-width", "Identifier": { "PURL": "pkg:npm/string-width@5.1.2", "UID": "d1552f855868fb2a" }, "Version": "5.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/string-width@5.1.2/node_modules/string-width/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "string_decoder@1.1.1", "Name": "string_decoder", "Identifier": { "PURL": "pkg:npm/string_decoder@1.1.1", "UID": "aea908965b06d920" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/string_decoder@1.1.1/node_modules/string_decoder/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "string_decoder@1.3.0", "Name": "string_decoder", "Identifier": { "PURL": "pkg:npm/string_decoder@1.3.0", "UID": "126a30c837d48617" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/string_decoder@1.3.0/node_modules/string_decoder/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "strip-ansi@6.0.1", "Name": "strip-ansi", "Identifier": { "PURL": "pkg:npm/strip-ansi@6.0.1", "UID": "16d28025cac0e31e" }, "Version": "6.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/strip-ansi@6.0.1/node_modules/strip-ansi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "strip-ansi@7.2.0", "Name": "strip-ansi", "Identifier": { "PURL": "pkg:npm/strip-ansi@7.2.0", "UID": "aeec0feead147ce1" }, "Version": "7.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/strip-ansi@7.2.0/node_modules/strip-ansi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tailwind-merge@3.5.0", "Name": "tailwind-merge", "Identifier": { "PURL": "pkg:npm/tailwind-merge@3.5.0", "UID": "541daefe0e8decf6" }, "Version": "3.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tailwind-merge@3.5.0/node_modules/tailwind-merge/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tailwindcss@4.2.2", "Name": "tailwindcss", "Identifier": { "PURL": "pkg:npm/tailwindcss@4.2.2", "UID": "45d81ab8e7770644" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tailwindcss@4.2.2/node_modules/tailwindcss/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tapable@2.3.0", "Name": "tapable", "Identifier": { "PURL": "pkg:npm/tapable@2.3.0", "UID": "863a01f62a63d427" }, "Version": "2.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tapable@2.3.0/node_modules/tapable/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tar@7.5.22", "Name": "tar", "Identifier": { "PURL": "pkg:npm/tar@7.5.22", "UID": "8453ddd6b6b062b7" }, "Version": "7.5.22", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/tar@7.5.22@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tar-fs@2.1.4", "Name": "tar-fs", "Identifier": { "PURL": "pkg:npm/tar-fs@2.1.4", "UID": "331a072caa202444" }, "Version": "2.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tar-fs@2.1.4/node_modules/tar-fs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tar-fs@3.1.2", "Name": "tar-fs", "Identifier": { "PURL": "pkg:npm/tar-fs@3.1.2", "UID": "1cd769940ba770a0" }, "Version": "3.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tar-fs@3.1.2/node_modules/tar-fs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tar-stream@2.2.0", "Name": "tar-stream", "Identifier": { "PURL": "pkg:npm/tar-stream@2.2.0", "UID": "d1f3ff17c56f42" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tar-stream@2.2.0/node_modules/tar-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tar-stream@3.1.8", "Name": "tar-stream", "Identifier": { "PURL": "pkg:npm/tar-stream@3.1.8", "UID": "4cc57cb96505fb5" }, "Version": "3.1.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tar-stream@3.1.8/node_modules/tar-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "teex@1.0.1", "Name": "teex", "Identifier": { "PURL": "pkg:npm/teex@1.0.1", "UID": "21accb82354e5eb3" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/teex@1.0.1/node_modules/teex/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "testcontainers@11.14.0", "Name": "testcontainers", "Identifier": { "PURL": "pkg:npm/testcontainers@11.14.0", "UID": "97cc8b789e424756" }, "Version": "11.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/testcontainers@11.14.0/node_modules/testcontainers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "text-decoder@1.2.7", "Name": "text-decoder", "Identifier": { "PURL": "pkg:npm/text-decoder@1.2.7", "UID": "cf1cdac836dff8d9" }, "Version": "1.2.7", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/text-decoder@1.2.7/node_modules/text-decoder/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tiny-invariant@1.3.3", "Name": "tiny-invariant", "Identifier": { "PURL": "pkg:npm/tiny-invariant@1.3.3", "UID": "338490c015333ca3" }, "Version": "1.3.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tiny-invariant@1.3.3/node_modules/tiny-invariant/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tinybench@2.9.0", "Name": "tinybench", "Identifier": { "PURL": "pkg:npm/tinybench@2.9.0", "UID": "9949a569325c19d0" }, "Version": "2.9.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tinybench@2.9.0/node_modules/tinybench/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tinyexec@1.0.4", "Name": "tinyexec", "Identifier": { "PURL": "pkg:npm/tinyexec@1.0.4", "UID": "9dd6aeda51b95375" }, "Version": "1.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tinyexec@1.0.4/node_modules/tinyexec/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tinyglobby@0.2.15", "Name": "tinyglobby", "Identifier": { "PURL": "pkg:npm/tinyglobby@0.2.15", "UID": "66cb114683e504a3" }, "Version": "0.2.15", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tinyglobby@0.2.15/node_modules/tinyglobby/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tinyglobby@0.2.17", "Name": "tinyglobby", "Identifier": { "PURL": "pkg:npm/tinyglobby@0.2.17", "UID": "ca5254dda506bf89" }, "Version": "0.2.17", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/tinyglobby@0.2.17@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tinyrainbow@3.1.0", "Name": "tinyrainbow", "Identifier": { "PURL": "pkg:npm/tinyrainbow@3.1.0", "UID": "da8101bea0c67efe" }, "Version": "3.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tinyrainbow@3.1.0/node_modules/tinyrainbow/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tmp@0.2.5", "Name": "tmp", "Identifier": { "PURL": "pkg:npm/tmp@0.2.5", "UID": "b5fa317dd5805851" }, "Version": "0.2.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tmp@0.2.5/node_modules/tmp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "to-regex-range@5.0.1", "Name": "to-regex-range", "Identifier": { "PURL": "pkg:npm/to-regex-range@5.0.1", "UID": "b8cd52a1820b8bfe" }, "Version": "5.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/to-regex-range@5.0.1/node_modules/to-regex-range/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "toidentifier@1.0.1", "Name": "toidentifier", "Identifier": { "PURL": "pkg:npm/toidentifier@1.0.1", "UID": "97f488c9433583e5" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/toidentifier@1.0.1/node_modules/toidentifier/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tslib@2.8.1", "Name": "tslib", "Identifier": { "PURL": "pkg:npm/tslib@2.8.1", "UID": "d35335c8decd3a39" }, "Version": "2.8.1", "Licenses": [ "0BSD" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tslib@2.8.1/node_modules/tslib/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tsx@4.21.0", "Name": "tsx", "Identifier": { "PURL": "pkg:npm/tsx@4.21.0", "UID": "1b1322855e15a9a" }, "Version": "4.21.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tsx@4.21.0/node_modules/tsx/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tweetnacl@0.14.5", "Name": "tweetnacl", "Identifier": { "PURL": "pkg:npm/tweetnacl@0.14.5", "UID": "4d63ddeaba56be99" }, "Version": "0.14.5", "Licenses": [ "Unlicense" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/tweetnacl@0.14.5/node_modules/tweetnacl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "type-is@2.1.0", "Name": "type-is", "Identifier": { "PURL": "pkg:npm/type-is@2.1.0", "UID": "96bb8e7810d48320" }, "Version": "2.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/type-is@2.1.0/node_modules/type-is/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "typescript@5.9.3", "Name": "typescript", "Identifier": { "PURL": "pkg:npm/typescript@5.9.3", "UID": "9731d178f115066" }, "Version": "5.9.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/typescript@5.9.3/node_modules/typescript/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "undici@7.25.0", "Name": "undici", "Identifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "Version": "7.25.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "undici@8.10.0", "Name": "undici", "Identifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "Version": "8.10.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "undici-types@6.21.0", "Name": "undici-types", "Identifier": { "PURL": "pkg:npm/undici-types@6.21.0", "UID": "58fcc5e13b589575" }, "Version": "6.21.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/undici-types@6.21.0/node_modules/undici-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "unpipe@1.0.0", "Name": "unpipe", "Identifier": { "PURL": "pkg:npm/unpipe@1.0.0", "UID": "994ab71a22921a48" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/unpipe@1.0.0/node_modules/unpipe/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "unplugin@2.3.11", "Name": "unplugin", "Identifier": { "PURL": "pkg:npm/unplugin@2.3.11", "UID": "84dd1c50baa0f606" }, "Version": "2.3.11", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/unplugin@2.3.11/node_modules/unplugin/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "update-browserslist-db@1.2.3", "Name": "update-browserslist-db", "Identifier": { "PURL": "pkg:npm/update-browserslist-db@1.2.3", "UID": "823efc9f27e708af" }, "Version": "1.2.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/update-browserslist-db@1.2.3+044c74c876d36fc3/node_modules/update-browserslist-db/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "use-callback-ref@1.3.3", "Name": "use-callback-ref", "Identifier": { "PURL": "pkg:npm/use-callback-ref@1.3.3", "UID": "5d04fd3c59803474" }, "Version": "1.3.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/use-callback-ref@1.3.3+26a211c426f3f87c/node_modules/use-callback-ref/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "use-sidecar@1.1.3", "Name": "use-sidecar", "Identifier": { "PURL": "pkg:npm/use-sidecar@1.1.3", "UID": "22a60d4dcb89e40f" }, "Version": "1.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/use-sidecar@1.1.3+26a211c426f3f87c/node_modules/use-sidecar/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "use-sync-external-store@1.6.0", "Name": "use-sync-external-store", "Identifier": { "PURL": "pkg:npm/use-sync-external-store@1.6.0", "UID": "2829246c16e6a008" }, "Version": "1.6.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/use-sync-external-store@1.6.0+b1ab299f0a400331/node_modules/use-sync-external-store/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "util-deprecate@1.0.2", "Name": "util-deprecate", "Identifier": { "PURL": "pkg:npm/util-deprecate@1.0.2", "UID": "8af0ad8f7a101e53" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/util-deprecate@1.0.2/node_modules/util-deprecate/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "uuid@10.0.0", "Name": "uuid", "Identifier": { "PURL": "pkg:npm/uuid@10.0.0", "UID": "8117cd58b7aefd6a" }, "Version": "10.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/uuid@10.0.0/node_modules/uuid/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "uuid@11.1.0", "Name": "uuid", "Identifier": { "PURL": "pkg:npm/uuid@11.1.0", "UID": "fd854f4990858150" }, "Version": "11.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/uuid@11.1.0/node_modules/uuid/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "vary@1.1.2", "Name": "vary", "Identifier": { "PURL": "pkg:npm/vary@1.1.2", "UID": "c173e563e2f6a67b" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/vary@1.1.2/node_modules/vary/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "victory-vendor@37.3.6", "Name": "victory-vendor", "Identifier": { "PURL": "pkg:npm/victory-vendor@37.3.6", "UID": "fad8243944599868" }, "Version": "37.3.6", "Licenses": [ "MIT AND ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/victory-vendor@37.3.6/node_modules/victory-vendor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "vite@6.4.1", "Name": "vite", "Identifier": { "PURL": "pkg:npm/vite@6.4.1", "UID": "dd3a8fbea00bcdf3" }, "Version": "6.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/vite@6.4.1+d6e2dda1aa32e95f/node_modules/vite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "vite@8.0.1", "Name": "vite", "Identifier": { "PURL": "pkg:npm/vite@8.0.1", "UID": "40fa74c680d5434a" }, "Version": "8.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/vite@8.0.1+73ecf28eeef21114/node_modules/vite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "vitest@4.1.4", "Name": "vitest", "Identifier": { "PURL": "pkg:npm/vitest@4.1.4", "UID": "ba1882aba422b494" }, "Version": "4.1.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/vitest@4.1.4+7deeb0ac885f2919/node_modules/vitest/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "w3c-keyname@2.2.8", "Name": "w3c-keyname", "Identifier": { "PURL": "pkg:npm/w3c-keyname@2.2.8", "UID": "da90768dd242d760" }, "Version": "2.2.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/w3c-keyname@2.2.8/node_modules/w3c-keyname/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "webpack-virtual-modules@0.6.2", "Name": "webpack-virtual-modules", "Identifier": { "PURL": "pkg:npm/webpack-virtual-modules@0.6.2", "UID": "1edaf0e79e9c5671" }, "Version": "0.6.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/webpack-virtual-modules@0.6.2/node_modules/webpack-virtual-modules/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "which@2.0.2", "Name": "which", "Identifier": { "PURL": "pkg:npm/which@2.0.2", "UID": "2b64f97ab9af7150" }, "Version": "2.0.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/which@2.0.2/node_modules/which/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "which@7.0.0", "Name": "which", "Identifier": { "PURL": "pkg:npm/which@7.0.0", "UID": "44e2e67cffeb74a" }, "Version": "7.0.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/which@7.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "which-module@2.0.1", "Name": "which-module", "Identifier": { "PURL": "pkg:npm/which-module@2.0.1", "UID": "ca7dca0efe567121" }, "Version": "2.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/which-module@2.0.1/node_modules/which-module/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "why-is-node-running@2.3.0", "Name": "why-is-node-running", "Identifier": { "PURL": "pkg:npm/why-is-node-running@2.3.0", "UID": "32f769659b15c55a" }, "Version": "2.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/why-is-node-running@2.3.0/node_modules/why-is-node-running/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "wrap-ansi@6.2.0", "Name": "wrap-ansi", "Identifier": { "PURL": "pkg:npm/wrap-ansi@6.2.0", "UID": "e8a342a6314e8b45" }, "Version": "6.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/wrap-ansi@6.2.0/node_modules/wrap-ansi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "wrap-ansi@7.0.0", "Name": "wrap-ansi", "Identifier": { "PURL": "pkg:npm/wrap-ansi@7.0.0", "UID": "d7b69a59a2178eaa" }, "Version": "7.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/wrap-ansi@7.0.0/node_modules/wrap-ansi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "wrap-ansi@8.1.0", "Name": "wrap-ansi", "Identifier": { "PURL": "pkg:npm/wrap-ansi@8.1.0", "UID": "f41da6443208356f" }, "Version": "8.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/wrap-ansi@8.1.0/node_modules/wrap-ansi/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "wrappy@1.0.2", "Name": "wrappy", "Identifier": { "PURL": "pkg:npm/wrappy@1.0.2", "UID": "d505b62e1aa91fcc" }, "Version": "1.0.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/wrappy@1.0.2/node_modules/wrappy/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "xtend@4.0.2", "Name": "xtend", "Identifier": { "PURL": "pkg:npm/xtend@4.0.2", "UID": "e5da4e1e8cc2e58" }, "Version": "4.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/xtend@4.0.2/node_modules/xtend/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "y18n@4.0.3", "Name": "y18n", "Identifier": { "PURL": "pkg:npm/y18n@4.0.3", "UID": "bac31ac36f7d84d4" }, "Version": "4.0.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/y18n@4.0.3/node_modules/y18n/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "y18n@5.0.8", "Name": "y18n", "Identifier": { "PURL": "pkg:npm/y18n@5.0.8", "UID": "2694acf3b38ca46f" }, "Version": "5.0.8", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/y18n@5.0.8/node_modules/y18n/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yallist@3.1.1", "Name": "yallist", "Identifier": { "PURL": "pkg:npm/yallist@3.1.1", "UID": "5f10dc4217759374" }, "Version": "3.1.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yallist@3.1.1/node_modules/yallist/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yallist@5.0.0", "Name": "yallist", "Identifier": { "PURL": "pkg:npm/yallist@5.0.0", "UID": "8c37e9e756730419" }, "Version": "5.0.0", "Licenses": [ "BlueOak-1.0.0" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "root/.bun/install/cache/yallist@5.0.0@@@1/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yaml@2.8.3", "Name": "yaml", "Identifier": { "PURL": "pkg:npm/yaml@2.8.3", "UID": "1e7c87cab90e4dd3" }, "Version": "2.8.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yaml@2.8.3/node_modules/yaml/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yargs@15.4.1", "Name": "yargs", "Identifier": { "PURL": "pkg:npm/yargs@15.4.1", "UID": "68e897fc4406b7d8" }, "Version": "15.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yargs@15.4.1/node_modules/yargs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yargs@17.7.2", "Name": "yargs", "Identifier": { "PURL": "pkg:npm/yargs@17.7.2", "UID": "ff1b7f4f3045f5aa" }, "Version": "17.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yargs@17.7.2/node_modules/yargs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yargs-parser@18.1.3", "Name": "yargs-parser", "Identifier": { "PURL": "pkg:npm/yargs-parser@18.1.3", "UID": "b0e9da90047efaf8" }, "Version": "18.1.3", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yargs-parser@18.1.3/node_modules/yargs-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yargs-parser@21.1.1", "Name": "yargs-parser", "Identifier": { "PURL": "pkg:npm/yargs-parser@21.1.1", "UID": "3a706eda42987fdc" }, "Version": "21.1.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/yargs-parser@21.1.1/node_modules/yargs-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "zip-stream@6.0.1", "Name": "zip-stream", "Identifier": { "PURL": "pkg:npm/zip-stream@6.0.1", "UID": "edb7ef18a8f8be57" }, "Version": "6.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/zip-stream@6.0.1/node_modules/zip-stream/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "zod@3.25.76", "Name": "zod", "Identifier": { "PURL": "pkg:npm/zod@3.25.76", "UID": "c81822c1e8fa4944" }, "Version": "3.25.76", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/zod@3.25.76/node_modules/zod/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "zod@4.3.6", "Name": "zod", "Identifier": { "PURL": "pkg:npm/zod@4.3.6", "UID": "94623eb1eab0dd89" }, "Version": "4.3.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/zod@4.3.6/node_modules/zod/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "zod-to-json-schema@3.25.2", "Name": "zod-to-json-schema", "Identifier": { "PURL": "pkg:npm/zod-to-json-schema@3.25.2", "UID": "7a609c5e76e679f0" }, "Version": "3.25.2", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/zod-to-json-schema@3.25.2+3c5d820c62823f0b/node_modules/zod-to-json-schema/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "zustand@5.0.12", "Name": "zustand", "Identifier": { "PURL": "pkg:npm/zustand@5.0.12", "UID": "7c2c64916acb47b6" }, "Version": "5.0.12", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "FilePath": "app/node_modules/.bun/zustand@5.0.12+67fdfcba9fdc8388/node_modules/zustand/package.json", "AnalyzedBy": "node-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-101916", "VendorIDs": [ "GHSA-m9gg-hp2v-232j" ], "PkgID": "@grpc/grpc-js@1.14.3", "PkgName": "@grpc/grpc-js", "PkgPath": "app/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40grpc/grpc-js@1.14.3", "UID": "db82d8f0b68f64c2" }, "InstalledVersion": "1.14.3", "FixedVersion": "1.13.6, 1.14.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-101916", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b40f39bb41a507a7fe9104f201c7bb9c3b555879594787a642d01158a498010b", "Title": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation", "Description": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-101916", "https://advisory.echohq.com/cve/CVE-2026-101916", "https://github.com/grpc/grpc-node", "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee", "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c", "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js@1.14.5", "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j", "https://nvd.nist.gov/vuln/detail/CVE-2026-101916", "https://www.cve.org/CVERecord?id=CVE-2026-101916" ], "PublishedDate": "2026-09-28T21:17:13.03Z", "LastModifiedDate": "2026-10-01T15:17:25.083Z" }, { "VulnerabilityID": "CVE-2026-48068", "VendorIDs": [ "GHSA-5375-pq7m-f5r2" ], "PkgID": "@grpc/grpc-js@1.14.3", "PkgName": "@grpc/grpc-js", "PkgPath": "app/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40grpc/grpc-js@1.14.3", "UID": "db82d8f0b68f64c2" }, "InstalledVersion": "1.14.3", "FixedVersion": "1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48068", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:4e0a5146988e24ddc2cec9861e52b891cddcbaf03433a4a92a10e19d722c389e", "Title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation", "Description": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.", "Severity": "HIGH", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-48068", "https://advisory.echohq.com/cve/CVE-2026-48068", "https://github.com/advisories/GHSA-5375-pq7m-f5r2", "https://github.com/grpc/grpc-node", "https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17", "https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7", "https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668", "https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba", "https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903", "https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.10.12", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.11.4", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.12.7", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.13.5", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.14.4", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.9.16", "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2", "https://nvd.nist.gov/vuln/detail/CVE-2026-48068", "https://www.cve.org/CVERecord?id=CVE-2026-48068" ], "PublishedDate": "2026-07-14T20:17:05.71Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-48069", "VendorIDs": [ "GHSA-99f4-grh7-6pcq" ], "PkgID": "@grpc/grpc-js@1.14.3", "PkgName": "@grpc/grpc-js", "PkgPath": "app/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40grpc/grpc-js@1.14.3", "UID": "db82d8f0b68f64c2" }, "InstalledVersion": "1.14.3", "FixedVersion": "1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48069", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:a25bf92bb0196fa9a82aa68dfdf4e54bc359af04fff7a1de402cf8f3a71a01e2", "Title": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message", "Description": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.", "Severity": "HIGH", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-48069", "https://advisory.echohq.com/cve/CVE-2026-48069", "https://github.com/advisories/GHSA-99f4-grh7-6pcq", "https://github.com/grpc/grpc-node", "https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c", "https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163", "https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5", "https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346", "https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb", "https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.10.12", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.11.4", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.12.7", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.13.5", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.14.4", "https://github.com/grpc/grpc-node/releases/tag/@grpc%2Fgrpc-js@1.9.16", "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq", "https://nvd.nist.gov/vuln/detail/CVE-2026-48069", "https://www.cve.org/CVERecord?id=CVE-2026-48069" ], "PublishedDate": "2026-07-14T20:17:05.867Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-104850", "VendorIDs": [ "GHSA-6qxp-vccf-f47h" ], "PkgID": "@modelcontextprotocol/sdk@1.30.0", "PkgName": "@modelcontextprotocol/sdk", "PkgPath": "app/node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40modelcontextprotocol/sdk@1.30.0", "UID": "3545723290d6d5f8" }, "InstalledVersion": "1.30.0", "FixedVersion": "1.31.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-104850", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e70bfd9bee48a196bc1c4ff11a3b45415f4ad3a62b105a91f5a13e3725357653", "Title": "@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials", "Description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.", "Severity": "HIGH", "CweIDs": [ "CWE-345", "CWE-522" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-104850", "https://advisory.echohq.com/cve/CVE-2026-104850", "https://github.com/modelcontextprotocol/typescript-sdk", "https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2887", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0", "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h", "https://nvd.nist.gov/vuln/detail/CVE-2026-104850", "https://www.cve.org/CVERecord?id=CVE-2026-104850" ], "PublishedDate": "2026-10-06T17:17:15.827Z", "LastModifiedDate": "2026-10-06T20:03:40.69Z" }, { "VulnerabilityID": "CVE-2026-111767", "VendorIDs": [ "GHSA-22jm-h49p-29qw" ], "PkgID": "@modelcontextprotocol/sdk@1.30.0", "PkgName": "@modelcontextprotocol/sdk", "PkgPath": "app/node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40modelcontextprotocol/sdk@1.30.0", "UID": "3545723290d6d5f8" }, "InstalledVersion": "1.30.0", "FixedVersion": "1.32.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111767", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:0e35cf6187801aac2b436654615941d985972d4c645ff68e63c371672389055a", "Title": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore", "Description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.", "Severity": "HIGH", "CweIDs": [ "CWE-639", "CWE-862" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-111767", "https://advisory.echohq.com/cve/CVE-2026-111767", "https://github.com/modelcontextprotocol/typescript-sdk", "https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2925", "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw", "https://nvd.nist.gov/vuln/detail/CVE-2026-111767", "https://www.cve.org/CVERecord?id=CVE-2026-111767" ], "PublishedDate": "2026-10-20T19:17:30.847Z", "LastModifiedDate": "2026-10-20T19:53:10.247Z" }, { "VulnerabilityID": "CVE-2026-111768", "VendorIDs": [ "GHSA-46jr-4wx8-v453" ], "PkgID": "@modelcontextprotocol/sdk@1.30.0", "PkgName": "@modelcontextprotocol/sdk", "PkgPath": "app/node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40modelcontextprotocol/sdk@1.30.0", "UID": "3545723290d6d5f8" }, "InstalledVersion": "1.30.0", "FixedVersion": "1.32.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111768", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:506e160301c5a1541f82c2cbd6d3a33ecd7cfd558c9953f190b80563b43493f8", "Title": "@modelcontextprotocol/sdk: @modelcontextprotocol/server: Model Context Protocol TypeScript SDK: Denial of service via memory exhaustion from crafted HTTP requests", "Description": "The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-111768", "https://advisory.echohq.com/cve/CVE-2026-111768", "https://github.com/modelcontextprotocol/typescript-sdk", "https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37", "https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2926", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2927", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0", "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453", "https://nvd.nist.gov/vuln/detail/CVE-2026-111768", "https://www.cve.org/CVERecord?id=CVE-2026-111768" ], "PublishedDate": "2026-11-05T22:17:45.457Z", "LastModifiedDate": "2026-11-05T22:17:45.457Z" }, { "VulnerabilityID": "GHSA-f897-62hf-6gxq", "PkgID": "@modelcontextprotocol/sdk@1.30.0", "PkgName": "@modelcontextprotocol/sdk", "PkgPath": "app/node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40modelcontextprotocol/sdk@1.30.0", "UID": "3545723290d6d5f8" }, "InstalledVersion": "1.30.0", "FixedVersion": "1.30.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:fbd15cecd254b80904b73722295590e9bfb728af6a0d96b8fff7c7e1f8df753d", "Title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "Description": "### Summary\nIn affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless your application authenticates requests before they reach the SDK.\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over Streamable HTTP. A body parser such as `express.json()` does not protect you, because it does not limit batch length. Servers that only use stdio are not affected.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.10.0 through 1.30.0\n- `@modelcontextprotocol/server` 2.0.0\n- `@modelcontextprotocol/node` 2.0.0\n- `@modelcontextprotocol/hono` 2.0.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.30.1 or later\n- 2.x: `@modelcontextprotocol/server` 2.1.0, `@modelcontextprotocol/node` 2.1.0 and `@modelcontextprotocol/hono` 2.0.1 or later. Upgrade every one you have installed.\n\nBodies over 4 MiB now get `413`, and batches over 100 messages get `400`. If your clients send larger bodies, raise the new `maxRequestBodySize` option.\n\nIf you cannot upgrade yet, cap request body size in a reverse proxy.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-f897-62hf-6gxq", "https://github.com/advisories/GHSA-f897-62hf-6gxq", "https://github.com/modelcontextprotocol/typescript-sdk", "https://github.com/modelcontextprotocol/typescript-sdk/commit/7b781ed4e25355a25d15974f3c76de81299694ed", "https://github.com/modelcontextprotocol/typescript-sdk/commit/a9f6eb709b85459d01e8f2a9e881fef2621756c1", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2698", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2717", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.1", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/hono@2.0.1", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/node@2.1.0", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.1.0", "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq" ], "PublishedDate": "2026-10-27T19:02:00Z", "LastModifiedDate": "2026-10-27T19:02:00Z" }, { "VulnerabilityID": "GHSA-j95f-988m-3j2f", "PkgID": "@tiptap/core@3.29.2", "PkgName": "@tiptap/core", "PkgPath": "app/node_modules/.bun/@tiptap+core@3.29.2+cd99e66c7117853e/node_modules/@tiptap/core/package.json", "PkgIdentifier": { "PURL": "pkg:npm/%40tiptap/core@3.29.2", "UID": "91728d672c49da10" }, "InstalledVersion": "3.29.2", "FixedVersion": "3.30.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-j95f-988m-3j2f", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ee64c2087667f475899b8dd317fd1749c37c7de3561dc1babebc4af608f66703", "Title": "Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing", "Description": "## Summary\n\n`@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes. Inline shortcode attributes use another unanchored greedy key expression that rescans a long word-character run when no equals sign follows.\n\nThe public `createAtomBlockMarkdownSpec` and `createBlockMarkdownSpec` helpers call the vulnerable Pandoc-style parser; `createInlineMarkdownSpec` calls the separately vulnerable shortcode parser. Using unmodified npm 3.29.2, a complete 20,508-byte atom-block token took approximately 1.40 seconds while an equal-length control took 0.29 ms. A complete 32,776-byte inline token took approximately 2.21 seconds while its equal-length control took 0.19 ms. Current repository `main` commit `5158212970344952dd9918b6a44bfb400d7fb6c1` retains both expressions.\n\n## Block attribute root cause\n\n`packages/core/src/utilities/markdown/attributeUtils.ts` uses both `matchAll` and `replace` with `/([a-zA-Z][\\w-]*)\\s*=\\s*(__QUOTED_\\d+__)/g`. The candidate is `'__QUOTED_0'.repeat(n) + '__QUOTED_0__'`. There are no quotes, so the preceding replacement leaves it unchanged. At each `Q`, the greedy key-name expression consumes the remaining word-character run, the required equals sign fails, and the unanchored engine restarts at the next `Q`. This yields `O(n^2)` work, and the cleanup pass repeats it.\n\nA complete public-API proof is:\n\n```js\nimport { createAtomBlockMarkdownSpec } from '@tiptap/core'\nconst tokenizer = createAtomBlockMarkdownSpec({ nodeName: 'probe' }).markdownTokenizer\nconst attack = '__QUOTED_0'.repeat(2048) + '__QUOTED_0__'\nconst source = `:::probe {${attack}} :::\\n`\nconst started = performance.now()\ntokenizer.tokenize(source, [], {})\nconsole.log(performance.now() - started)\n```\n\nMeasured complete-tokenizer timings were 6.23, 23.12, 88.93, 369.10, and 1,400.17 ms at 1,308, 2,588, 5,148, 10,268, and 20,508 bytes. Equal-length controls took 0.07 to 0.29 ms. The directly exported parser took 5,645.71 ms at 40,972 bytes while its control took 0.64 ms.\n\n## Inline attribute root cause\n\n`packages/core/src/utilities/markdown/createInlineMarkdownSpec.ts` uses `/(\\w+)=(?:\"([^\"]*)\"|'([^']*)')/g`. For a long word-character run without an equals sign, `\\w+` consumes the remaining suffix, `=` fails, and the unanchored engine restarts at the next character. The default inline tokenizer extracts this attacker string directly from a syntactically complete `[shortcode attributes]` token.\n\n```js\nimport { createInlineMarkdownSpec } from '@tiptap/core'\nconst tokenizer = createInlineMarkdownSpec({ nodeName: 'probe', selfClosing: true }).markdownTokenizer\nconst source = `[probe ${'0'.repeat(32768)}]`\nconst started = performance.now()\ntokenizer.tokenize(source, [], {})\nconsole.log(performance.now() - started)\n```\n\nAt 1,032, 2,056, 4,104, 8,200, 16,392, and 32,776 bytes, candidates took 3.24, 12.88, 54.82, 136.91, 557.83, and 2,209.47 ms. Equal-length hyphen controls took 0.02 to 0.19 ms.\n\n## Impact\n\nApplications parsing attacker-controlled Markdown with these helpers can have a browser main thread, server event loop, or worker blocked by a small input. Persisted documents can repeatedly freeze clients; repeated requests can exhaust server-side parsing capacity. Editors that only consume validated ProseMirror JSON and never invoke the Markdown parsing path are not directly affected through document content.\n\n## History and remediation\n\nCommit `35645d94ae9cd73448a564104c2e08f64e9564bc` introduced both parsers on 14 October 2025, first released in 3.7.0. Versions 3.7.0 through current 3.29.2 and current `main` remain affected. Official issue, PR, and repository-advisory searches found no duplicate.\n\nRequire a start-of-string or whitespace boundary before both key-value parsers, and preferably replace the multi-pass placeholder and shortcode regex designs with deterministic single-pass tokenizers. Keep quoted values out-of-band so attacker input cannot collide with predictable `__QUOTED_n__` placeholders. Add complete block and inline Markdown-tokenizer scaling regressions with equal-length controls.\n\nPlease credit GitHub user `joostgrunwald` as finder/reporter.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-j95f-988m-3j2f", "https://github.com/advisories/GHSA-j95f-988m-3j2f", "https://github.com/ueberdosis/tiptap", "https://github.com/ueberdosis/tiptap/commit/d0d499be3cce633cf54ca9aa9f3d8a5a1f98bd74", "https://github.com/ueberdosis/tiptap/releases/tag/v3.30.5", "https://github.com/ueberdosis/tiptap/security/advisories/GHSA-j95f-988m-3j2f" ], "PublishedDate": "2026-09-08T21:24:09Z", "LastModifiedDate": "2026-09-08T21:24:09Z" }, { "VulnerabilityID": "CVE-2026-114607", "VendorIDs": [ "GHSA-965c-763c-88jm" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.7.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-114607", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b6fc37c315956012d1d9373875abb84396e2c40a52c858e6505ea304e18d13b1", "Title": "better-auth: OAuth state can be used as a Magic Link to sign in as another user", "Description": "Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.", "Severity": "CRITICAL", "CweIDs": [ "CWE-287" ], "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a", "https://github.com/better-auth/better-auth/pull/11494", "https://github.com/better-auth/better-auth/releases/tag/v1.7.7", "https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm", "https://nvd.nist.gov/vuln/detail/CVE-2026-114607" ], "PublishedDate": "2026-10-22T17:16:58.577Z", "LastModifiedDate": "2026-10-23T15:17:26.763Z" }, { "VulnerabilityID": "CVE-2026-53512", "VendorIDs": [ "GHSA-pw9m-5jxm-xr6h" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53512", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:9cd98944e7339990313e9d05e2964b18606ffb7c53d809e289c831a064e3cee6", "Title": "Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins", "Description": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.", "Severity": "CRITICAL", "CweIDs": [ "CWE-287", "CWE-306", "CWE-345", "CWE-863" ], "VendorSeverity": { "ghsa": 4, "nvd": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V3Score": 9.1, "V40Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c", "https://github.com/better-auth/better-auth/pull/9576", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-pw9m-5jxm-xr6h", "https://nvd.nist.gov/vuln/detail/CVE-2026-53512" ], "PublishedDate": "2026-07-15T18:16:47.42Z", "LastModifiedDate": "2026-07-21T13:33:47.543Z" }, { "VulnerabilityID": "CVE-2026-53514", "VendorIDs": [ "GHSA-fmh4-wcc4-5jm3" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53514", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:d852657ed13db565057bf3b4443cbbad8c4e7c499140232ea6a5ec794c1b7ff5", "Title": "Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin", "Description": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.", "Severity": "HIGH", "CweIDs": [ "CWE-287", "CWE-345", "CWE-441", "CWE-862" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 7.7 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8", "https://github.com/better-auth/better-auth/pull/9577", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-fmh4-wcc4-5jm3", "https://nvd.nist.gov/vuln/detail/CVE-2026-53514" ], "PublishedDate": "2026-07-15T18:16:47.683Z", "LastModifiedDate": "2026-07-21T13:41:03.313Z" }, { "VulnerabilityID": "CVE-2026-53516", "VendorIDs": [ "GHSA-g38m-r43w-p2q7" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53516", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b09143f6d87824c6c71d0e23b5fe9a68fc610a9ad7f4d890ddffa42c16d56871", "Title": "Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email", "Description": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.", "Severity": "HIGH", "CweIDs": [ "CWE-287", "CWE-345" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 8.3 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/da7e50beee849c59a2ed1ec6b3a38cc6ab9fb563", "https://github.com/better-auth/better-auth/pull/9578", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-g38m-r43w-p2q7", "https://nvd.nist.gov/vuln/detail/CVE-2026-53516" ], "PublishedDate": "2026-07-15T18:16:47.967Z", "LastModifiedDate": "2026-07-21T14:14:22.307Z" }, { "VulnerabilityID": "CVE-2026-53517", "VendorIDs": [ "GHSA-392p-2q2v-4372" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53517", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:5649cc86757ae72a9ef4b05abf54f58185f2df0691a6b8ef3e6eee495fe455fc", "Title": "Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption", "Description": "Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-367" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V3Score": 8.1, "V40Score": 7.6 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d", "https://github.com/better-auth/better-auth/releases/tag/v1.6.0", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372", "https://nvd.nist.gov/vuln/detail/CVE-2026-53517" ], "PublishedDate": "2026-07-15T18:16:48.107Z", "LastModifiedDate": "2026-07-21T16:00:22.173Z" }, { "VulnerabilityID": "CVE-2026-53518", "VendorIDs": [ "GHSA-7w99-5wm4-3g79" ], "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53518", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:bc0ee1c7dad40dc9a40485cde5c925eb0eb4a432eb734c82559dde66722bb217", "Title": "@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive", "Description": "Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-367" ], "VendorSeverity": { "ghsa": 3, "nvd": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V3Score": 8.1, "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g79", "https://nvd.nist.gov/vuln/detail/CVE-2026-53518" ], "PublishedDate": "2026-07-15T18:16:48.24Z", "LastModifiedDate": "2026-07-21T16:03:12.347Z" }, { "VulnerabilityID": "GHSA-86j7-9j95-vpqj", "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.13, 1.7.0-beta.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-86j7-9j95-vpqj", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:33e96d8cd6a73837e96ec3cd9f53285a3682a94c349f4dc508d02c02c306ca64", "Title": "Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp", "Description": "### Am I affected?\n\nCheck each condition. Users are affected when all of the first three hold.\n\n- Their application enables the `oidc-provider` plugin or the `mcp` plugin from `better-auth/plugins`. The `mcp` plugin wraps the same provider and carries the same defect. Both are on the migration path to `@better-auth/oauth-provider`, which is not affected.\n- Their application `better-auth` version is `1.6.12` or earlier on the stable line, or any `1.7.0-beta` build on the pre-release line. Both release lines carry the same defect.\n- Their application consent page is a client component that reads `redirectURI` from the `authClient.oauth2.consent(...)` response and assigns it to a browser navigation target such as `window.location.href`, `location.assign`, or `location.replace`.\n\nTwo conditions raise an application's exposure:\n\n- It sets `allowDynamicClientRegistration: true`. Client registration is then unauthenticated, so any visitor can plant the malicious client. The default is `false`, which limits planting to authenticated users.\n- It exposes the consent page to ordinary end users rather than to a restricted operator audience.\n\nA developer's application is not affected when any of these hold:\n\n- Their application copied the project's `consent-buttons.tsx` demo verbatim. That file reads a `uri` field that this plugin never returns, so its navigation branch never runs and it falls through to an error toast.\n- Their application completse the consent flow with a server-side redirect, for example a Next.js or Remix server action. Browsers do not follow a `javascript:` URL delivered in a `Location` response header.\n- Their application uses `@better-auth/oauth-provider` instead of the deprecated `oidc-provider` plugin.\n\nFix:\n\n1. Upgrade to `better-auth@1.6.13` (stable) or `1.7.0-beta.4` (pre-release).\n2. If developers cannot upgrade their applications, see the workarounds below.\n\n### Summary\n\nThe deprecated `oidc-provider` plugin registers OAuth clients without validating the scheme of their `redirect_uris`. An attacker stores a `javascript:` URI as a client redirect target, and the authorization server later returns that URI to the browser in the consent response. A consent page that navigates to the returned value then executes attacker JavaScript in the authorization-server origin, which exposes the victim's session and enables account takeover. The `mcp` plugin wraps the same provider and carries the same defect, so MCP server deployments are affected as well; like `oidc-provider`, it is migrating to `@better-auth/oauth-provider`.\n\n### Details\n\nClient registration accepts any string. The registration body schema types `redirect_uris` as `z.array(z.string())` with no scheme check, so `POST /oauth2/register` stores a value such as `javascript:fetch('/api/auth/get-session')//`. In the default configuration, `allowDynamicClientRegistration` is `false`, so registration requires an authenticated session; any logged-in user qualifies. With dynamic client registration enabled, registration is unauthenticated.\n\nThe dangerous value then survives the authorization-code flow unchanged. `GET /oauth2/authorize` matches the request `redirect_uri` against the stored list by exact string equality, so the registered `javascript:` URI matches itself and is written into the consent verification record. When the user approves on the consent screen, the handler runs `new URL(value.redirectURI)`, appends the authorization code through `searchParams.set`, and returns the result in JSON under the key `redirectURI`. The `javascript:` scheme passes through `new URL` intact, and a trailing `//` in the payload comments out the appended query string.\n\nThe plugin documents the consent call but not the redirect step that follows it, and it gives no warning that `redirectURI` can carry a dangerous scheme. The natural way an operator completes the flow is to assign `res.data.redirectURI` to `window.location.href`. Per the URL specification and browser behavior, navigating `window.location` to a `javascript:` URL executes the script body in the current document origin, which here is the authorization server. The injected script can call `/api/auth/get-session` and any other session-scoped endpoint in that origin.\n\nThe sibling `@better-auth/oauth-provider` package already prevents this. It validates the same field with `SafeUrlSchema`, which rejects the `javascript:`, `data:`, and `vbscript:` schemes and requires HTTPS or a loopback host. The deprecated plugin never received that control; the field shipped unvalidated when the registration endpoint was first added, well before the sibling package introduced `SafeUrlSchema`.\n\n### Patches\n\nFixed in `better-auth@1.6.13` (stable) and `1.7.0-beta.4` (pre-release). The fix adds scheme validation to the `redirect_uris` of both the `oidc-provider` and `mcp` plugins, matching the control `@better-auth/oauth-provider` already enforces.\n\n### Workarounds\n\nIf developers cannot upgrade, apply one of the following.\n\n- Harden the consent page. Before navigating, parse the returned value and navigate only when its scheme is `http:` or `https:`. For example, reject the value when `new URL(redirectURI).protocol` is neither `http:` nor `https:`, and show an error instead of navigating. This closes the sink regardless of what the server returns.\n- Migrate to `@better-auth/oauth-provider`. It validates redirect URIs at registration and is the supported replacement for the deprecated plugin.\n- Keep `allowDynamicClientRegistration` at its default of `false` and restrict who can register clients. This does not remove the issue, because any authenticated user can still register a malicious client, but it removes the unauthenticated path.\n\n### Impact\n\nThis is a stored DOM cross-site scripting issue in the authorization server's own origin, which leads to account takeover. An attacker who can register a client plants a `javascript:` redirect URI. A victim who visits the attacker's authorize URL and approves consent runs attacker JavaScript in the authorization-server origin. From there the script reads `/api/auth/get-session`, calls any session-scoped endpoint, and takes over the account. The consent screen shows the attacker-controlled client name, which makes the approval click easy to socially engineer.\n\nThe realized impact depends on one operator-side precondition: the consent page must assign the returned `redirectURI` to a navigation target. Better Auth itself never performs that navigation, which is why the assessed Attack Complexity is High and the score sits below a pure server-side execution flaw. The deprecated status of the `oidc-provider` plugin does not reduce the impact. The plugin remains published, importable, and documented, and users on the affected versions cannot opt out without changing their integration. The `mcp` plugin wraps the same provider and is affected on the same versions; its docs announce a move to `@better-auth/oauth-provider`, but until users migrate or upgrade, the affected published versions stay exposed. `@better-auth/oauth-provider` validates redirect URIs and provides MCP support, so it is the migration target for both plugins.\n\n### Credit\n\nReported by @hillalee \n\n### Resources\n\n- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). https://cwe.mitre.org/data/definitions/79.html\n- CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). https://cwe.mitre.org/data/definitions/601.html\n- RFC 6749 (OAuth 2.0) Section 3.1.2, Redirection Endpoint: the redirection endpoint URI must be an absolute URI. https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2\n- MDN, javascript: URLs: navigating `window.location` to a `javascript:` URL executes the script body. https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 7.7 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/releases/tag/v1.6.13", "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.4", "https://github.com/better-auth/better-auth/security/advisories/GHSA-86j7-9j95-vpqj" ], "PublishedDate": "2026-07-07T20:55:28Z", "LastModifiedDate": "2026-07-07T20:55:28Z" }, { "VulnerabilityID": "GHSA-9h47-pqcx-hjr4", "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-9h47-pqcx-hjr4", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ae3e71bd5c1b1c8ad909b70ccd93f8999b2aec4fe1a332a71cb24c3e9cfd7dfa", "Title": "Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default", "Description": "### Am I affected?\n\nUsers are affected if all of the following are true:\n\n- Their application uses `better-auth` at a version below the patched release.\n- Their application enables `oidcProvider()` from `better-auth/plugins/oidc-provider` or `mcp()` from `better-auth/plugins/mcp` (the mcp plugin delegates to `oidcProvider` and inherits both defaults).\n- For the algorithm-negotiation impact: relying parties of the application's OIDC server use a JWT verification library that performs algorithm negotiation from the discovery document without pinning to a specific signing algorithm.\n- For the PKCE impact: the authorization URL is exposed to any party other than the user agent and the application's OP.\n\nIf the application only uses `@better-auth/oauth-provider` (the canonical replacement) and have not enabled the legacy plugins, it is not affected. The new package's discovery document excludes `none` and its authorize schema rejects `plain` at parse time.\n\nFix:\n\n1. Upgrade to `better-auth@1.6.11` or later.\n2. Migrate from the deprecated `oidcProvider` and `mcp` plugins to `@better-auth/oauth-provider` when feasible.\n3. If developers cannot upgrade their applications, see workarounds below.\n\n### Summary\n\nThe legacy `oidcProvider` and `mcp` plugins exhibit two related defects in their OIDC discovery and authorize surfaces.\n\nThe discovery document advertises `\"none\"` in `id_token_signing_alg_values_supported` (and, for `mcp`, in `resource_signing_alg_values_supported` on the OAuth protected-resource metadata). Any relying party that performs algorithm negotiation from this metadata without pinning to a real signing algorithm may accept unsigned tokens.\n\nPKCE `plain` is enabled by default. The runtime gate in the authorize handler accepts `code_challenge_method=plain` under this default, and a missing `code_challenge_method` parameter is silently downgraded to `\"plain\"` before the allowlist check. Discovery advertises `code_challenge_methods_supported: [\"S256\"]`, contradicting the runtime acceptance of `plain`. RFC 9700 §2.1.1 (OAuth 2.1) explicitly forbids `plain`.\n\n### Details\n\nThe metadata builders unconditionally inject `\"none\"` into the alg list. The runtime authorize gate is structured so a buggy client that strips the `code_challenge_method` parameter still enters the plain code path because the handler rewrites the missing value to `\"plain\"` before the allowlist check fires.\n\n`@better-auth/oauth-provider` (the deprecation target for `oidcProvider`) is not affected by either defect. The metadata builder uses a `JWSAlgorithms` type union that structurally excludes `\"none\"`. The authorize schema is `code_challenge_method: z.literal(\"S256\").optional()`, which rejects `plain` at parse time.\n\n### Patches\n\nFixed in `better-auth@1.6.11`. The legacy `oidcProvider` and `mcp` plugins now:\n\n- Drop `\"none\"` from `id_token_signing_alg_values_supported` (both plugins) and from `resource_signing_alg_values_supported` (`mcp`). Discovery no longer advertises the unsigned-token option.\n- Default `allowPlainCodeChallengeMethod` to `false`. A request that explicitly passes `code_challenge_method=plain` is rejected with `invalid_request` unless the integrator opts in.\n- Reject a `code_challenge` without an accompanying `code_challenge_method` instead of silently rewriting the missing value to `plain`. Clients that send `code_challenge` must also send `code_challenge_method=S256`.\n\nDiscovery and runtime behavior align on `S256` only by default.\n\nIntegrators who must keep plain PKCE for legacy clients can restore the previous shape with `oidcProvider({ allowPlainCodeChallengeMethod: true })` (and likewise for `mcp`). With the opt-in set, a request that omits `code_challenge_method` is treated as `plain` again, preserving backwards compatibility while keeping the secure default for everyone else. Both legacy plugins are deprecated long-term; the recommended migration is `@better-auth/oauth-provider`, which never advertised `none` or accepted plain PKCE.\n\n### Workarounds\n\nIf developers cannot upgrade their applications immediately:\n\n- **Disable plain PKCE explicitly**: set `oidcProvider({ allowPlainCodeChallengeMethod: false })` (and the equivalent on `mcp`). Closes the runtime acceptance of `plain` even though the silent downgrade still rewrites missing methods.\n- **Override the metadata** to drop `\"none\"` from `id_token_signing_alg_values_supported`. For `oidcProvider`, pass `metadata: { id_token_signing_alg_values_supported: [\"RS256\"] }`. For `mcp`, set the same on `options.oidcConfig.metadata`. Verify by curling the `.well-known` endpoint.\n- **Migrate to `@better-auth/oauth-provider`**: the package is the deprecation target and is unaffected by both defects.\n\n### Impact\n\n- **Algorithm-negotiation downgrade**: relying parties that read the discovery document without pinning may accept unsigned (`alg: \"none\"`) tokens.\n- **Authorization-code interception**: PKCE `plain` does not protect the authorization code if the URL leaks (Referer headers, browser history, screen capture, proxy logs). PKCE `S256` is what protects against that exposure; with `plain` the protection is absent.\n- **OAuth 2.1 / RFC 9700 non-conformance**: deployments shipping the defaults are non-compliant with current standards.\n\n### Credit\n\nReported by @subhanUmer.\n\n### Resources\n\n- [CWE-327: Use of a Broken or Risky Cryptographic Algorithm](https://cwe.mitre.org/data/definitions/327.html)\n- [CWE-757: Selection of Less-Secure Algorithm During Negotiation](https://cwe.mitre.org/data/definitions/757.html)\n- [CWE-1188: Insecure Default Initialization of Resource](https://cwe.mitre.org/data/definitions/1188.html)\n- [RFC 9700 §2.1.1: PKCE](https://datatracker.ietf.org/doc/html/rfc9700#section-2.1.1)\n- [RFC 9700 §2.1.2: Token Replay Prevention](https://datatracker.ietf.org/doc/html/rfc9700#section-2.1.2)\n- [RFC 8414 §2: Authorization Server Metadata](https://datatracker.ietf.org/doc/html/rfc8414#section-2)", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4" ], "PublishedDate": "2026-07-07T20:55:41Z", "LastModifiedDate": "2026-07-07T20:55:41Z" }, { "VulnerabilityID": "GHSA-q84f-53jg-9ppm", "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.7.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-q84f-53jg-9ppm", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:c4703218a9e28f4f29b8a8726f04624fd921aecb0bbb97635921c9053b2785b6", "Title": "better-auth: Device login approval does not show the requesting client or permissions", "Description": "## Am I affected?\n\nYou may be affected if you use `better-auth` from `1.3.8-beta.3` up to, but not including, `1.7.0-rc.3`, and you enable the `deviceAuthorization()` plugin. This range includes all 1.6 releases.\n\nYou are affected only if all of these are also true:\n\n- An attacker can start a device request: `validateClient` is not configured, or the attacker can use a valid public client.\n- Before allowing approval, your approval page does not show, from server-checked data, which client is asking and the exact permissions it requests.\n- Users may approve a code or complete verification link they did not start and cannot compare with a device they have.\n- Your application accepts the session token that the device flow returns, for example through the bearer plugin.\n\nYou are not affected if you do not enable the opt-in `deviceAuthorization()` plugin.\n\n## Summary\n\nThe device authorization plugin lets a user sign in on one device by approving a short code on another. In affected versions, the approval information given to the user leaves out which client asked for access and which permissions it wants. The official approval examples therefore show only a generic request and a code, so users cannot tell their own device from an attacker's request.\n\n## Impact\n\nAn attacker who convinces a signed-in user to approve the attacker's code receives a live Better Auth session token for that user. The attacker can then read or change any data the user's account can access. The attack needs the opt-in device flow, a request the attacker creates, and a user who actively approves it; it is not a sign-in bypass without user action.\n\n## Patches\n\nThe fix first shipped in `1.7.0-rc.3`. Upgrade to `better-auth@1.7.0` or later. No 1.6 release contains the fix.\n\nAfter upgrading, `GET /device` returns the requesting `client_id` and `scope` to the signed-in account that owns the request. If you built your own approval page, update it to show that client and those permissions, and keep approval disabled until they load.\n\n## Workarounds\n\nIf you cannot upgrade yet, do the following:\n\n- Disable `deviceAuthorization()`, or block untrusted access to `/device/code`.\n- Configure a strict `validateClient` allowlist. Do not rely on the allowlist alone: it limits who can start the flow, but it does not give users the missing approval information.\n- Build your own approval endpoint. It should read the pending request from trusted server-side storage and map the checked client identifier to a trusted display name. Show the exact requested permissions and the user code. Keep approval disabled until this information loads.\n- Tell users to reject device requests they did not expect. They should approve only when the same code is visible right now on a device they have.\n\n## Technical details\n\nA device starts the flow by calling `/device/code`. The plugin stores the client identifier and any requested scope with the pending request. Before approval, `GET /device` returns only the user code and its status. This is true even for a signed-in session of the user account that owns the request. An approval page built from that response cannot show which client asked for access or which permissions it wants. After approval, the original device code can be redeemed at `/device/token` for a Better Auth session token.\n\nRFC 8628 describes this remote phishing scenario. It recommends that the server tell users they are authorizing a device and ask them to confirm that the device is in their possession. It also recommends showing device information that helps users detect impersonation. Client allowlisting reduces who can start the flow, but it does not give users the missing approval information. A valid public client can therefore still be affected when its identifier and requested permissions are not shown.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/f68044dcfbd9fb83763249ed9509cfacbcce47be", "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-rc.3", "https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm" ], "PublishedDate": "2026-10-27T14:49:53Z", "LastModifiedDate": "2026-10-27T14:49:53Z" }, { "VulnerabilityID": "GHSA-qq9h-g4jm-xgf3", "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.6.22, 1.7.0-beta.10", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-qq9h-g4jm-xgf3", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ace07994e658ffddbb33bbbb7e1ce8f0bd1614d79bfaa5699ddbd7ed701155c7", "Title": "Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in", "Description": "### Am I affected\n\nYou are affected if all of the following hold:\n\n- You run a `better-auth` version below 1.6.22, or a `1.7.0-beta` below `1.7.0-beta.10`.\n- You enable the magic-link plugin or the email-OTP plugin.\n- You also enable email and password sign-up with open registration.\n- An account can exist at an address before its owner first signs in with the passwordless flow.\n\n### Summary\n\nAn attacker can keep password access to a victim's account after the victim starts using it. The attack runs in three steps. First, with open registration, the attacker signs up using the victim's email and a password the attacker picks. The account stays unverified, so the attacker cannot use it yet. Later the real owner signs in with a magic link or an email OTP. That step marks the account verified, and the attacker's password now works on it.\n\n### Details\n\nWhen an account already exists for an address, magic-link verification and email-OTP sign-in both sign in to that account. They mark it verified and issue a session. Before the fix, neither one removed a password set while the account was still unverified. Neither one revoked existing sessions. So a password set before anyone proved control of the mailbox kept working after the owner proved control.\n\nThis is a pre-account-hijacking weakness. It is the same class as the OAuth advisory GHSA-g38m-r43w-p2q7, applied to the passwordless email flows. Requiring email verification does not stop it. The verification step is the exact moment that turns the planted account into a usable one.\n\nThe fix treats current proof of control over the address as authoritative. When either flow finds an account whose email was never confirmed, it now removes the password and revokes existing sessions first. Only then does it mark the account verified and issue the new session. The owner signs in as before. Only access created before the proof is removed.\n\n### Patches\n\nUpgrade to `better-auth` 1.6.22 or later on the stable line. On the 1.7 pre-release line, upgrade to `1.7.0-beta.10` or later. Earlier 1.7 betas, up to and including `1.7.0-beta.9`, still contain the bug.\n\n### Workarounds\n\nIf you cannot upgrade right away, you can lower the risk in two ways. Require email verification before you accept any password on an account. Remove unverified accounts quickly, so an address cannot sit reserved for long. Both steps shrink the opening, but they do not close it. Upgrading is the real fix.\n\n### Impact\n\nThe attacker gains lasting password access to an account the victim depends on, alongside the victim. From there the attacker can read and change the victim's data. The attacker can also reset the credentials and lock the victim out. The takeover only completes when the victim signs in through the passwordless flow. It also needs a setup that pairs that flow with open email and password sign-up.\n\n### Credit\n\nReported by the Vercel security team.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 8.3 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110", "https://github.com/better-auth/better-auth/pull/10239", "https://github.com/better-auth/better-auth/releases/tag/v1.6.22", "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10", "https://github.com/better-auth/better-auth/security/advisories/GHSA-qq9h-g4jm-xgf3" ], "PublishedDate": "2026-07-24T15:44:01Z", "LastModifiedDate": "2026-07-24T15:44:01Z" }, { "VulnerabilityID": "GHSA-r4xp-prcw-77qf", "PkgID": "better-auth@1.5.6", "PkgName": "better-auth", "PkgPath": "app/node_modules/.bun/better-auth@1.5.6+030a8c4f5d7b6b0c/node_modules/better-auth/package.json", "PkgIdentifier": { "PURL": "pkg:npm/better-auth@1.5.6", "UID": "27cdb86f2be9c141" }, "InstalledVersion": "1.5.6", "FixedVersion": "1.7.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-r4xp-prcw-77qf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:6c35dfa22776f554f7f3661ec95ae20b967e333c3a80958d2e0f4f6b1108b52e", "Title": "better-auth: OAuth Proxy lets an attacker sign in as another user", "Description": "## Am I affected?\n\nYou may be affected if you use `better-auth` from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true:\n\n- On a participating environment, the OAuth Proxy plugin has no dedicated `secret`, or its `secret` equals that environment's global Better Auth secret.\n- Sign-in state is stored in a cookie (`account.storeStateStrategy: \"cookie\"`). With a database or secondary storage, this is only the case if you chose it explicitly.\n- Implicit account linking is on (the default).\n\nYou are not affected by this path if every participating environment uses a proxy `secret` distinct from its global Better Auth secret, if sign-in state is stored in the database, or if you use a version before 1.5.0-beta.12.\n\n## Summary\n\nThe OAuth Proxy plugin trusts any user profile it can decrypt. In the affected setup, Better Auth encrypts sign-in state, including data the caller chose, with the same secret and hands it to anyone who starts a social sign-in. An attacker can use this to get a fake profile for another user's email address that the proxy accepts as real.\n\n## Impact\n\nAn attacker without an account who knows a user's verified email address can sign in as that user, with that user's permissions. They can read private data, change the account, and link a provider account of their choice to it. They need no provider sign-in and no action from the victim. No availability impact is established, and a reported open redirect was not confirmed.\n\n## Patches\n\nThe fix is merged for the planned `better-auth` 1.7.7 release. That package is not available yet.\n\nUpgrade all nodes handling the same cookie-backed OAuth or SAML state flow and all OAuth Proxy participants together, including the production coordinator and preview or development deployments. Keep installed Better Auth packages released alongside `better-auth` on the same release version. Restart pending sign-in and account-linking flows; pre-upgrade state cookies and proxy payloads are rejected. Public options and API signatures are unchanged.\n\n## Workarounds\n\nUntil you upgrade to the fixed release, apply one of these:\n\n- Set one strong OAuth Proxy `secret` across every environment that takes part in the proxy flow, and keep it different from each environment's global Better Auth secret.\n- Set `account.storeStateStrategy: \"database\"`. This is already the default when a database or secondary storage is configured. If Magic Link is also enabled, switching can expose a separate cross-purpose verification-record path in affected releases. Ensure the two flows resolve to distinct stored identifiers; with built-in options, use Magic Link `storeToken: \"hashed\"` with global `verification.storeIdentifier` unset or `\"plain\"`, or disable Magic Link or both built-in social and Generic OAuth sign-in.\n- Remove the OAuth Proxy plugin if you do not need it.\n\nSetting `account.accountLinking.disableImplicitLinking: true` stops this path from taking over an existing account. It does not fix the underlying flaw: the callback can still accept attacker-made data as a provider identity. Apply one of the steps above as well.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://github.com/better-auth/better-auth", "https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a", "https://github.com/better-auth/better-auth/pull/11494", "https://github.com/better-auth/better-auth/releases/tag/v1.7.7", "https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf" ], "PublishedDate": "2026-10-27T15:32:16Z", "LastModifiedDate": "2026-10-27T15:32:16Z" }, { "VulnerabilityID": "CVE-2026-111181", "VendorIDs": [ "GHSA-27r3-jxmh-p828" ], "PkgID": "body-parser@2.3.0", "PkgName": "body-parser", "PkgPath": "app/node_modules/.bun/body-parser@2.3.0/node_modules/body-parser/package.json", "PkgIdentifier": { "PURL": "pkg:npm/body-parser@2.3.0", "UID": "8e5348c4b38348cc" }, "InstalledVersion": "2.3.0", "FixedVersion": "2.4.0, 1.20.9", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111181", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:3c9265aa8254c9f2bc6ed246bf78fa49f2bb47c681b2260daf3d7588a955a9f3", "Title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "Description": "body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.", "Severity": "HIGH", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-111181", "https://advisory.echohq.com/cve/CVE-2026-111181", "https://cna.openjsf.org/security-advisories.html", "https://github.com/expressjs/body-parser", "https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7", "https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916", "https://github.com/expressjs/body-parser/releases/tag/1.20.9", "https://github.com/expressjs/body-parser/releases/tag/v2.4.0", "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828", "https://nvd.nist.gov/vuln/detail/CVE-2026-111181", "https://www.cve.org/CVERecord?id=CVE-2026-111181" ], "PublishedDate": "2026-10-22T15:17:04.763Z", "LastModifiedDate": "2026-10-22T19:17:35.797Z" }, { "VulnerabilityID": "CVE-2026-102276", "VendorIDs": [ "GHSA-6j4f-fj2g-mc7p" ], "PkgID": "brace-expansion@2.1.0", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "InstalledVersion": "2.1.0", "FixedVersion": "5.0.10, 3.0.7, 2.1.5, 1.1.19", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102276", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e61be82e222989074e8ec1496399d8b2bbcfff3044f2462c4c32c0b6389bb54f", "Title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-674" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-102276", "https://advisory.echohq.com/cve/CVE-2026-102276", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "https://linux.oracle.com/cve/CVE-2026-102276.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102276", "https://www.cve.org/CVERecord?id=CVE-2026-102276" ], "PublishedDate": "2026-09-28T21:17:16.033Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2026-102278", "VendorIDs": [ "GHSA-qhr7-859c-m2p7" ], "PkgID": "brace-expansion@2.1.0", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "InstalledVersion": "2.1.0", "FixedVersion": "5.0.11, 3.0.8, 2.1.6, 1.1.20", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102278", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:a953ea93df963439134311f5ca04a5a3c9f5cf5dc91df384022710ccaeb7366b", "Title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-674" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-102278", "https://advisory.echohq.com/cve/CVE-2026-102278", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "https://linux.oracle.com/cve/CVE-2026-102278.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102278", "https://www.cve.org/CVERecord?id=CVE-2026-102278" ], "PublishedDate": "2026-09-28T21:17:16.517Z", "LastModifiedDate": "2026-10-01T15:17:25.593Z" }, { "VulnerabilityID": "CVE-2026-13149", "VendorIDs": [ "GHSA-3jxr-9vmj-r5cp" ], "PkgID": "brace-expansion@2.1.0", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "InstalledVersion": "2.1.0", "FixedVersion": "5.0.7, 1.1.16, 2.1.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13149", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:f6908e8d2f6986bd1f49140585e61fbc4a281a170b9c12bbcb19f4124b1c790b", "Title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity", "Description": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "V3Score": 5.3, "V40Score": 7.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47058", "https://access.redhat.com/security/cve/CVE-2026-13149", "https://advisory.echohq.com/cve/CVE-2026-13149", "https://bugzilla.redhat.com/2494813", "https://bugzilla.redhat.com/2498116", "https://bugzilla.redhat.com/2498120", "https://bugzilla.redhat.com/show_bug.cgi?id=2494813", "https://bugzilla.redhat.com/show_bug.cgi?id=2498116", "https://bugzilla.redhat.com/show_bug.cgi?id=2498120", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59873", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59874", "https://errata.almalinux.org/9/ALSA-2026-47058.html", "https://errata.rockylinux.org/RLSA-2026:47058", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265", "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "https://github.com/juliangruber/brace-expansion/pull/122", "https://github.com/juliangruber/brace-expansion/pull/123", "https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16", "https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2", "https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp", "https://linux.oracle.com/cve/CVE-2026-13149.html", "https://linux.oracle.com/errata/ELSA-2026-48034.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-13149", "https://www.cve.org/CVERecord?id=CVE-2026-13149", "https://www.npmjs.com/package/brace-expansion" ], "PublishedDate": "2026-06-30T10:16:34.56Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-14257", "VendorIDs": [ "GHSA-mh99-v99m-4gvg" ], "PkgID": "brace-expansion@2.1.0", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "InstalledVersion": "2.1.0", "FixedVersion": "5.0.8, 3.0.3, 2.1.3, 1.1.17", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14257", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:0a50258d6f46df4d71654dd247cbd504eb991bbcef46128302b114736fe53fd4", "Title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function", "Description": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55603", "https://access.redhat.com/security/cve/CVE-2026-14257", "https://advisory.echohq.com/cve/CVE-2026-14257", "https://bugzilla.redhat.com/2506433", "https://bugzilla.redhat.com/2507593", "https://bugzilla.redhat.com/2510722", "https://bugzilla.redhat.com/2510801", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://bugzilla.redhat.com/show_bug.cgi?id=2506433", "https://bugzilla.redhat.com/show_bug.cgi?id=2507593", "https://bugzilla.redhat.com/show_bug.cgi?id=2510722", "https://bugzilla.redhat.com/show_bug.cgi?id=2510801", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192", "https://errata.almalinux.org/9/ALSA-2026-55603.html", "https://errata.rockylinux.org/RLSA-2026:55603", "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb", "https://github.com/juliangruber/brace-expansion/pull/129", "https://github.com/juliangruber/brace-expansion/pull/130", "https://github.com/juliangruber/brace-expansion/pull/136", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg", "https://linux.oracle.com/cve/CVE-2026-14257.html", "https://linux.oracle.com/errata/ELSA-2026-58819.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14257", "https://www.cve.org/CVERecord?id=CVE-2026-14257", "https://www.npmjs.com/package/brace-expansion" ], "PublishedDate": "2026-07-23T14:17:00.25Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-69152", "VendorIDs": [ "GHSA-rgw5-rvv9-x895" ], "PkgID": "brace-expansion@2.1.0", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@2.1.0/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@2.1.0", "UID": "440cb8ca83d1e559" }, "InstalledVersion": "2.1.0", "FixedVersion": "1.1.18, 2.1.4, 3.0.6, 5.0.9", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69152", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:46383c0efd5bca56e620dd93143583b296b326a8a28803e92d075806851959a1", "Title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55603", "https://access.redhat.com/security/cve/CVE-2026-69152", "https://advisory.echohq.com/cve/CVE-2026-69152", "https://bugzilla.redhat.com/2506433", "https://bugzilla.redhat.com/2507593", "https://bugzilla.redhat.com/2510722", "https://bugzilla.redhat.com/2510801", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://bugzilla.redhat.com/show_bug.cgi?id=2506433", "https://bugzilla.redhat.com/show_bug.cgi?id=2507593", "https://bugzilla.redhat.com/show_bug.cgi?id=2510722", "https://bugzilla.redhat.com/show_bug.cgi?id=2510801", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192", "https://errata.almalinux.org/9/ALSA-2026-55603.html", "https://errata.rockylinux.org/RLSA-2026:55603", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "https://linux.oracle.com/cve/CVE-2026-69152.html", "https://linux.oracle.com/errata/ELSA-2026-58819.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-69152", "https://www.cve.org/CVERecord?id=CVE-2026-69152" ], "PublishedDate": "2026-08-03T17:16:45.953Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-102276", "VendorIDs": [ "GHSA-6j4f-fj2g-mc7p" ], "PkgID": "brace-expansion@5.0.5", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "InstalledVersion": "5.0.5", "FixedVersion": "5.0.10, 3.0.7, 2.1.5, 1.1.19", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102276", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:2fc763a56360a15e5b4bfbebc90b3c19509361d786ae8e07a807a66a29f0e68b", "Title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-674" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-102276", "https://advisory.echohq.com/cve/CVE-2026-102276", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "https://linux.oracle.com/cve/CVE-2026-102276.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102276", "https://www.cve.org/CVERecord?id=CVE-2026-102276" ], "PublishedDate": "2026-09-28T21:17:16.033Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2026-102278", "VendorIDs": [ "GHSA-qhr7-859c-m2p7" ], "PkgID": "brace-expansion@5.0.5", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "InstalledVersion": "5.0.5", "FixedVersion": "5.0.11, 3.0.8, 2.1.6, 1.1.20", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-102278", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:055699e272f5e35fad1b5b19ced8c439def37e6bb841916a216931e830874605", "Title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-674" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92378", "https://access.redhat.com/security/cve/CVE-2026-102278", "https://advisory.echohq.com/cve/CVE-2026-102278", "https://bugzilla.redhat.com/2542596", "https://bugzilla.redhat.com/2542700", "https://bugzilla.redhat.com/2542706", "https://bugzilla.redhat.com/2542707", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2559870", "https://bugzilla.redhat.com/2559873", "https://bugzilla.redhat.com/2559875", "https://bugzilla.redhat.com/2560016", "https://bugzilla.redhat.com/2560018", "https://bugzilla.redhat.com/2560019", "https://bugzilla.redhat.com/2560021", "https://bugzilla.redhat.com/2560022", "https://bugzilla.redhat.com/show_bug.cgi?id=2542596", "https://bugzilla.redhat.com/show_bug.cgi?id=2542700", "https://bugzilla.redhat.com/show_bug.cgi?id=2542706", "https://bugzilla.redhat.com/show_bug.cgi?id=2542707", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://bugzilla.redhat.com/show_bug.cgi?id=2559870", "https://bugzilla.redhat.com/show_bug.cgi?id=2559873", "https://bugzilla.redhat.com/show_bug.cgi?id=2559875", "https://bugzilla.redhat.com/show_bug.cgi?id=2560016", "https://bugzilla.redhat.com/show_bug.cgi?id=2560018", "https://bugzilla.redhat.com/show_bug.cgi?id=2560019", "https://bugzilla.redhat.com/show_bug.cgi?id=2560021", "https://bugzilla.redhat.com/show_bug.cgi?id=2560022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105482", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105483", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://errata.almalinux.org/9/ALSA-2026-92378.html", "https://errata.rockylinux.org/RLSA-2026:92378", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "https://linux.oracle.com/cve/CVE-2026-102278.html", "https://linux.oracle.com/errata/ELSA-2026-92378.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-102278", "https://www.cve.org/CVERecord?id=CVE-2026-102278" ], "PublishedDate": "2026-09-28T21:17:16.517Z", "LastModifiedDate": "2026-10-01T15:17:25.593Z" }, { "VulnerabilityID": "CVE-2026-13149", "VendorIDs": [ "GHSA-3jxr-9vmj-r5cp" ], "PkgID": "brace-expansion@5.0.5", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "InstalledVersion": "5.0.5", "FixedVersion": "5.0.7, 1.1.16, 2.1.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13149", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:936da26e40825f310a14b6ccf6a411e62bfeec35fb6e2a72e09b65dd2389f359", "Title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity", "Description": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "V3Score": 5.3, "V40Score": 7.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47058", "https://access.redhat.com/security/cve/CVE-2026-13149", "https://advisory.echohq.com/cve/CVE-2026-13149", "https://bugzilla.redhat.com/2494813", "https://bugzilla.redhat.com/2498116", "https://bugzilla.redhat.com/2498120", "https://bugzilla.redhat.com/show_bug.cgi?id=2494813", "https://bugzilla.redhat.com/show_bug.cgi?id=2498116", "https://bugzilla.redhat.com/show_bug.cgi?id=2498120", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59873", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59874", "https://errata.almalinux.org/9/ALSA-2026-47058.html", "https://errata.rockylinux.org/RLSA-2026:47058", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265", "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "https://github.com/juliangruber/brace-expansion/pull/122", "https://github.com/juliangruber/brace-expansion/pull/123", "https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16", "https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2", "https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp", "https://linux.oracle.com/cve/CVE-2026-13149.html", "https://linux.oracle.com/errata/ELSA-2026-48034.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-13149", "https://www.cve.org/CVERecord?id=CVE-2026-13149", "https://www.npmjs.com/package/brace-expansion" ], "PublishedDate": "2026-06-30T10:16:34.56Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-14257", "VendorIDs": [ "GHSA-mh99-v99m-4gvg" ], "PkgID": "brace-expansion@5.0.5", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "InstalledVersion": "5.0.5", "FixedVersion": "5.0.8, 3.0.3, 2.1.3, 1.1.17", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14257", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:d03035b3b8bdabaa85f1c2bdcb9d164e8b6ba7c9f6b9615223af78750e75310f", "Title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function", "Description": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55603", "https://access.redhat.com/security/cve/CVE-2026-14257", "https://advisory.echohq.com/cve/CVE-2026-14257", "https://bugzilla.redhat.com/2506433", "https://bugzilla.redhat.com/2507593", "https://bugzilla.redhat.com/2510722", "https://bugzilla.redhat.com/2510801", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://bugzilla.redhat.com/show_bug.cgi?id=2506433", "https://bugzilla.redhat.com/show_bug.cgi?id=2507593", "https://bugzilla.redhat.com/show_bug.cgi?id=2510722", "https://bugzilla.redhat.com/show_bug.cgi?id=2510801", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192", "https://errata.almalinux.org/9/ALSA-2026-55603.html", "https://errata.rockylinux.org/RLSA-2026:55603", "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb", "https://github.com/juliangruber/brace-expansion/pull/129", "https://github.com/juliangruber/brace-expansion/pull/130", "https://github.com/juliangruber/brace-expansion/pull/136", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg", "https://linux.oracle.com/cve/CVE-2026-14257.html", "https://linux.oracle.com/errata/ELSA-2026-58819.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14257", "https://www.cve.org/CVERecord?id=CVE-2026-14257", "https://www.npmjs.com/package/brace-expansion" ], "PublishedDate": "2026-07-23T14:17:00.25Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-69152", "VendorIDs": [ "GHSA-rgw5-rvv9-x895" ], "PkgID": "brace-expansion@5.0.5", "PkgName": "brace-expansion", "PkgPath": "app/node_modules/.bun/brace-expansion@5.0.5/node_modules/brace-expansion/package.json", "PkgIdentifier": { "PURL": "pkg:npm/brace-expansion@5.0.5", "UID": "5aa57cab70095998" }, "InstalledVersion": "5.0.5", "FixedVersion": "1.1.18, 2.1.4, 3.0.6, 5.0.9", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69152", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e275787bfd251a837da4a70eaa2423187e3bb6f133a43270962e183abc670047", "Title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "Description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55603", "https://access.redhat.com/security/cve/CVE-2026-69152", "https://advisory.echohq.com/cve/CVE-2026-69152", "https://bugzilla.redhat.com/2506433", "https://bugzilla.redhat.com/2507593", "https://bugzilla.redhat.com/2510722", "https://bugzilla.redhat.com/2510801", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://bugzilla.redhat.com/show_bug.cgi?id=2506433", "https://bugzilla.redhat.com/show_bug.cgi?id=2507593", "https://bugzilla.redhat.com/show_bug.cgi?id=2510722", "https://bugzilla.redhat.com/show_bug.cgi?id=2510801", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69192", "https://errata.almalinux.org/9/ALSA-2026-55603.html", "https://errata.rockylinux.org/RLSA-2026:55603", "https://github.com/juliangruber/brace-expansion", "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "https://linux.oracle.com/cve/CVE-2026-69152.html", "https://linux.oracle.com/errata/ELSA-2026-58819.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-69152", "https://www.cve.org/CVERecord?id=CVE-2026-69152" ], "PublishedDate": "2026-08-03T17:16:45.953Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-73088", "VendorIDs": [ "GHSA-73wf-gq98-2v4g" ], "PkgID": "browserslist@4.28.1", "PkgName": "browserslist", "PkgPath": "app/node_modules/.bun/browserslist@4.28.1+044c74c876d36fc3/node_modules/browserslist/package.json", "PkgIdentifier": { "PURL": "pkg:npm/browserslist@4.28.1", "UID": "e478147711353835" }, "InstalledVersion": "4.28.1", "FixedVersion": "4.28.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-73088", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:7836bc67ef745293a5809d3d0a1fc0fb1cbf6cc1c7a4a63347dcacbf9ddc671b", "Title": "browserslist: Browserslist: Prototype pollution leading to denial of service", "Description": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-1321" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-73088", "https://github.com/browserslist/browserslist", "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51", "https://github.com/browserslist/browserslist/releases/tag/4.28.7", "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g", "https://nvd.nist.gov/vuln/detail/CVE-2026-73088", "https://www.cve.org/CVERecord?id=CVE-2026-73088" ], "PublishedDate": "2026-08-11T17:19:16.977Z", "LastModifiedDate": "2026-09-09T20:44:04.357Z" }, { "VulnerabilityID": "CVE-2026-73089", "VendorIDs": [ "GHSA-c83g-rgw3-j3cx" ], "PkgID": "browserslist@4.28.1", "PkgName": "browserslist", "PkgPath": "app/node_modules/.bun/browserslist@4.28.1+044c74c876d36fc3/node_modules/browserslist/package.json", "PkgIdentifier": { "PURL": "pkg:npm/browserslist@4.28.1", "UID": "e478147711353835" }, "InstalledVersion": "4.28.1", "FixedVersion": "4.28.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-73089", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:9108a888a0d1b5c796c64e58d73b85d0f85cb2a1203444f6fd91862a201747fb", "Title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results", "Description": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-73089", "https://github.com/browserslist/browserslist", "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405", "https://github.com/browserslist/browserslist/releases/tag/4.28.7", "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx", "https://nvd.nist.gov/vuln/detail/CVE-2026-73089", "https://www.cve.org/CVERecord?id=CVE-2026-73089" ], "PublishedDate": "2026-08-11T17:19:17.123Z", "LastModifiedDate": "2026-09-09T20:44:04.357Z" }, { "VulnerabilityID": "CVE-2026-35209", "VendorIDs": [ "GHSA-737v-mqg7-c878" ], "PkgID": "defu@6.1.4", "PkgName": "defu", "PkgPath": "app/node_modules/.bun/defu@6.1.4/node_modules/defu/package.json", "PkgIdentifier": { "PURL": "pkg:npm/defu@6.1.4", "UID": "2a77ae4f20d5ff2a" }, "InstalledVersion": "6.1.4", "FixedVersion": "6.1.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-35209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b944ea5e45a2f0461950392c163b138f79171f56a58ede261a31b9db4a8f3ae5", "Title": "defu: Prototype pollution via `__proto__` key in defaults argument", "Description": "defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution. A crafted payload containing a `__proto__` key can override intended default values in the merged resul. The internal `_defu` function used `Object.assign({}, defaults)` to copy the defaults object. `Object.assign` invokes the `__proto__` setter, which replaces the resulting object's `[[Prototype]]` with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing `__proto__` key guard in the `for...in` loop and land in the final result. Version 6.1.5 replaces `Object.assign({}, defaults)` with object spread (`{ ...defaults }`), which uses `[[DefineOwnProperty]]` and does not invoke the `__proto__` setter.", "Severity": "HIGH", "CweIDs": [ "CWE-1321" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://github.com/unjs/defu", "https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29", "https://github.com/unjs/defu/pull/156", "https://github.com/unjs/defu/releases/tag/v6.1.5", "https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878", "https://nvd.nist.gov/vuln/detail/CVE-2026-35209" ], "PublishedDate": "2026-04-06T18:16:44.157Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "GHSA-cg2g-xh64-v4q7", "PkgID": "dompurify@3.4.12", "PkgName": "dompurify", "PkgPath": "app/node_modules/.bun/dompurify@3.4.12/node_modules/dompurify/package.json", "PkgIdentifier": { "PURL": "pkg:npm/dompurify@3.4.12", "UID": "eb89d0641cfa791b" }, "InstalledVersion": "3.4.12", "FixedVersion": "3.4.17", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:c549c51ea0790bb48f93ab66b0a6e537081016b0ba474f258beb0a8d6a152f15", "Title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "Description": "## Summary\n\nWhen DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and `\u003c%...%\u003e` survive sanitization inside the text content of an attached shadow root. The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:1717`) was extended to recurse into `\u003ctemplate\u003e.content`, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow root (the `IN_PLACE` and shadow-aware `RETURN_DOM` surfaces) can split an expression across text nodes separated by disallowed elements; after those elements are removed the fragments become adjacent and serialize into a complete expression that a downstream template engine will evaluate.\n\n## Root Cause\n\n`SAFE_FOR_TEMPLATES` neutralizes template expressions through two mechanisms: a per-text-node strip during the main walk (`_stripTemplateExpressions`, applied in `_sanitizeElements` at `src/purify.ts:2246`), and a final post-walk pass (`_scrubTemplateExpressions`, `src/purify.ts:1717`) that normalizes adjacent text nodes and re-strips expressions that only form after merging. The per-node strip cannot catch an expression that is split into individual fragments, because each fragment fails the delimiter regexes. The post-walk pass is the only mechanism that would catch the merged form, but it is structurally unable to reach shadow root content.\n\n```text\n_scrubTemplateExpressions (src/purify.ts:1717-1751):\n - node.normalize() at line 1718 does not merge text nodes inside shadow roots (DOM spec).\n - NodeIterator at lines 1723-1731 does not descend into shadow trees (DOM spec).\n - Explicit recursion at lines 1743-1750 enters \u003ctemplate\u003e.content only, via\n querySelectorAll('template'); there is no equivalent recursion into attached\n shadow roots.\nShadow roots are sanitized earlier by _sanitizeShadowDOM (src/purify.ts:2710), which\napplies the per-node strip but never performs the post-walk normalize-and-rescrub.\n```\n\nShadow root text nodes are therefore sanitized only per-node and never re-examined as a merged unit.\n\n## Impact\n\nAn attacker who controls DOM-node input containing an attached shadow root can inject template expressions that survive sanitization and are later evaluated by the application's template engine. In client-side contexts this yields cross-site scripting; in a server-side template context it can escalate to template injection. Exploitation requires non-default application configuration: the application must enable `SAFE_FOR_TEMPLATES` and a DOM-returning mode, pass a DOM node that already has an attached shadow root, and feed the sanitized shadow root content into a template evaluator. The shadow root does not have to be built programmatically with `attachShadow`: in engines that support declarative shadow DOM, attacker-supplied markup containing `\u003ctemplate shadowrootmode=\"open\"\u003e` parsed through `setHTMLUnsafe` or `Document.parseHTMLUnsafe` produces the same attached shadow root, so a plain HTML string reaches the gap once the application is configured this way. Demonstrated capability is injection of a complete, attacker-chosen expression into post-sanitization shadow root content; the resulting script execution and any confidentiality or integrity consequence depend on the downstream engine's evaluation context.\n\n## Proof of Concept\n\n```text\nPreconditions:\n - DOMPurify built from the affected source (dist/purify.js or an ESM/CJS bundle).\n - A browser (or DOM implementation) with shadow DOM support.\n - Application constructs a DOM node with an attached shadow root before sanitizing,\n and later evaluates the shadow root's text content as a template.\n```\n\nBuild a host element whose shadow root holds a template expression split across text nodes separated by disallowed elements, then sanitize in place with `SAFE_FOR_TEMPLATES`:\n\n```javascript\nconst host = document.createElement('div');\nconst root = host.attachShadow({ mode: 'open' });\n\n// Split \"${alert(document.domain)}\" so no single fragment matches a regex.\n// \u003cobject\u003e is not in the default ALLOWED_TAGS and is removed during sanitization,\n// leaving the surrounding text-node siblings adjacent.\nroot.appendChild(document.createTextNode('$'));\nroot.appendChild(document.createElement('object'));\nroot.appendChild(document.createTextNode('{alert(document.domain)}'));\n\nDOMPurify.sanitize(host, { IN_PLACE: true, SAFE_FOR_TEMPLATES: true });\n\n// After the disallowed element is removed, the fragments are adjacent and survive.\nhost.shadowRoot.normalize();\nconsole.log(host.shadowRoot.textContent);\n```\n\n```text\n${alert(document.domain)}\n```\n\nA downstream template evaluator reading `shadowRoot.textContent` (for example `new Function('return `' + content + '`')()` or any `${...}`/`{{...}}` engine) then evaluates the fully formed expression.\n\n## Attack Chain\n\n1. **Exposure:** The application calls `DOMPurify.sanitize(node, cfg)` (`src/purify.ts:2854`) with `SAFE_FOR_TEMPLATES: true` and `IN_PLACE: true` (or a shadow-aware `RETURN_DOM`), passing a DOM node that already carries an attached shadow root.\n2. **Control:** The attacker controls the shadow root's text nodes and the disallowed separator elements between them; each fragment (`$`, `{alert(document.domain)}`) is a valid, individually benign text node.\n3. **Path:** `_sanitizeAttachedShadowRoots` (`src/purify.ts:2977`) feeds the shadow root into `_sanitizeShadowDOM` (`src/purify.ts:2710`), which strips expressions per text node (`src/purify.ts:2246`) and removes the disallowed separator elements, leaving the fragments adjacent.\n4. **Guard:** The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:3131-3132`) is the only pass that would catch the merged expression, but it never recurses into shadow roots (`src/purify.ts:1717-1751` recurses into `\u003ctemplate\u003e.content` only).\n5. **Primitive:** The adjacent fragments serialize as a single concatenated string on `shadowRoot.textContent` / `shadowRoot.innerHTML`, reconstituting the complete expression.\n6. **Result:** A downstream template engine evaluates the attacker-chosen expression, achieving script execution (or template injection) in the engine's context.\n\n## Bypass Evidence\n\nThe relevant protection is `SAFE_FOR_TEMPLATES`, specifically the post-walk pass that defends against expressions that only form after adjacent text nodes merge. That defense was previously extended to `\u003ctemplate\u003e.content` under CVE-2026-65900 (GHSA-gvmj-g25r-r7wr) by adding `querySelectorAll('template')` recursion at `src/purify.ts:1743-1750`. The strongest challenge is whether any code path performs the equivalent merge-and-rescrub inside shadow roots. Enumerating every call site of `_scrubTemplateExpressions` (`src/purify.ts:1717`, `1747`, `3132`, `3141`) shows none receive a shadow root, and `_sanitizeShadowDOM` (`src/purify.ts:2710`) never calls `_scrubTemplateExpressions` or `normalize()`. The per-node strip cannot compensate: `MUSTACHE_EXPR` (`src/regexp.ts:3`) requires `{{` or `}}`, `TMPLIT_EXPR` (`src/regexp.ts:5`) requires `${`, and `ERB_EXPR` (`src/regexp.ts:4`) requires `\u003c%` or `%\u003e`, none of which appear in a single-character fragment. The CVE-2026-65900 regression tests exercise `\u003ctemplate\u003e.content` only; no test covers shadow root content under `SAFE_FOR_TEMPLATES`. The gap is therefore an unfixed case on a distinct remediation boundary (shadow roots) rather than a bypass of the delivered template-content fix.\n\n## Affected Versions\n\n- **Ecosystem:** `npm`\n- **Package:** `dompurify`\n- **Confirmed affected range:** `\u003e= 3.4.4, \u003c= 3.4.16`\n- **Latest release checked:** `3.4.16` ([npm registry](https://www.npmjs.com/package/dompurify/v/3.4.16))\n- **Fix status:** not fixed\n\nThe lower bound 3.4.4 is the release that introduced both the attached-shadow-root sanitization pass and the `_scrubTemplateExpressions` safety net; releases 3.4.4 through 3.4.7 carry the safety net with no content-container recursion, and 3.4.8 onward add `\u003ctemplate\u003e.content` recursion but still omit shadow root recursion. No published release and no current development revision contains a shadow-root fix.\n\n## Suggested Fix\n\nEnforce the same post-walk normalize-and-rescrub invariant on attached shadow roots that already applies to `\u003ctemplate\u003e.content`. After `_sanitizeShadowDOM` finishes walking a shadow root, run `_scrubTemplateExpressions` over that shadow root so adjacent text nodes created by element removal are merged and re-stripped; alternatively, have `_scrubTemplateExpressions` discover and recurse into attached shadow roots as it does for template content. The fix must cover nested shadow roots and shadow roots inside `\u003ctemplate\u003e.content`, and it must handle all three expression dialects, since any disallowed element can serve as the separator that produces adjacent fragments.\n\n---\n\nReported by zx (GitHub: @manus-pi).", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "V40Score": 9.2 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-cg2g-xh64-v4q7", "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "https://github.com/cure53/DOMPurify", "https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575", "https://github.com/cure53/DOMPurify/pull/1672", "https://github.com/cure53/DOMPurify/releases/tag/3.4.17", "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7" ], "PublishedDate": "2026-10-22T16:25:31Z", "LastModifiedDate": "2026-10-22T16:25:31Z" }, { "VulnerabilityID": "GHSA-mrv2-3pqr-j5jr", "PkgID": "dompurify@3.4.12", "PkgName": "dompurify", "PkgPath": "app/node_modules/.bun/dompurify@3.4.12/node_modules/dompurify/package.json", "PkgIdentifier": { "PURL": "pkg:npm/dompurify@3.4.12", "UID": "eb89d0641cfa791b" }, "InstalledVersion": "3.4.12", "FixedVersion": "3.4.17", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e6fdd2322c095c7cd03f60e9e2ab866285432d43e28d3a2765aeb94e9f8c27cf", "Title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "Description": "### Summary\n\nThe 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an `\u003cimg onerror\u003e` that was already loading fires after `sanitize()` returns.\n\nThe README says: \"Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an `\u003cimg onload\u003e` that was already loading when you built the live tree cannot fire after `sanitize()` returns.\" That does not hold when the detached node is not the hook's own node.\n\n### Tested versions\n\n- 3.4.16 (latest) and main at 18f8f0e\n- also 3.4.15, 3.4.12 and 2.5.8\n\njsdom for the matrix below, and Chromium (Playwright) for the event actually firing.\n\n### Details\n\n`src/purify.ts` line 2134 (`dist/purify.cjs.js` line 2009 in 3.4.16), `_handleHookDetachedNode()`:\n\n```js\nif (currentNode === root || getParentNode(currentNode) !== null) {\n return false;\n}\nif (IN_PLACE) {\n _neutralizeSubtree(currentNode);\n}\n```\n\nIt only checks whether `currentNode` lost its parent. When a hook removes `currentNode.parentNode` (or any ancestor), `currentNode` still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in `DOMPurify.removed`, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.\n\n### PoC (jsdom)\n\n```js\nconst { JSDOM } = require('jsdom')\nconst createDOMPurify = require('dompurify')\nconst win = new JSDOM('\u003c!doctype html\u003e\u003cbody\u003e\u003c/body\u003e').window\nconst doc = win.document\n\nfor (const mode of ['self', 'parent', 'nextSibling']) {\n const DOMPurify = createDOMPurify(win)\n doc.body.innerHTML = '\u003cdiv id=root\u003e\u003cfigure\u003e\u003cimg class=bad src=a.png\u003e' +\n '\u003cimg id=evil src=x onerror=alert(1)\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e'\n const root = doc.getElementById('root')\n const evil = doc.getElementById('evil')\n\n // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)\n DOMPurify.addHook('afterSanitizeAttributes', (node) =\u003e {\n if (node.getAttribute \u0026\u0026 node.getAttribute('class') === 'bad') {\n if (mode === 'self') node.remove()\n if (mode === 'parent') node.parentNode.remove()\n if (mode === 'nextSibling') node.nextElementSibling.remove()\n }\n })\n\n DOMPurify.sanitize(root, { IN_PLACE: true })\n console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))\n}\n```\n\nOutput on 3.4.16:\n\n```\n3.4.16 self onerror = null\n3.4.16 parent onerror = \"alert(1)\"\n3.4.16 nextSibling onerror = \"alert(1)\"\n```\n\nIn `self` mode the walker still reaches the second image and strips `onerror`. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of `beforeSanitizeElements`, `uponSanitizeElement`, `afterSanitizeElements`, `beforeSanitizeAttributes` and `afterSanitizeAttributes`.\n\n### PoC (browser)\n\nThe same thing in a real page, served from 127.0.0.1 and opened in Chromium:\n\n```html\n\u003c!doctype html\u003e\u003cmeta charset=utf-8\u003e\n\u003cscript src=\"purify.min.js\"\u003e\u003c/script\u003e\n\u003cbody\u003e\u003cpre id=log\u003e\u003c/pre\u003e\n\u003cscript\u003e\nwindow.fired = [];\nfunction run(mode) {\n const D = DOMPurify(window);\n D.addHook('afterSanitizeAttributes', n =\u003e {\n if (n.getAttribute \u0026\u0026 n.getAttribute('class') === 'bad') {\n if (mode === 'parent') n.parentNode.remove();\n if (mode === 'self') n.remove();\n }\n });\n const root = document.createElement('div');\n document.body.appendChild(root);\n root.innerHTML = '\u003cfigure\u003e\u003cimg class=bad src=data:,\u003e\u003cimg src=x onerror=\"fired.push(\\'' + mode + '\\')\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e';\n D.sanitize(root, { IN_PLACE: true });\n return root.outerHTML;\n}\nconst a = run('self'), b = run('parent');\nsetTimeout(() =\u003e {\n document.getElementById('log').textContent =\n 'version=' + DOMPurify.version + '\\nself out=' + a + '\\nparent out=' + b + '\\nfired=' + JSON.stringify(fired);\n}, 1500);\n\u003c/script\u003e\n```\n\nResult on 3.4.16:\n\n```\nversion=3.4.16\nself out=\u003cdiv\u003e\u003cfigure\u003e\u003cimg src=\"x\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nparent out=\u003cdiv\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nfired=[\"parent\"]\n```\n\nThe returned tree is clean in both cases, but the handler on the detached image runs in the page for `parent`.\n\n### Impact\n\nAn app that uses `IN_PLACE` with a hook that removes a wrapper or a nearby element (for example \"drop the whole `\u003cfigure\u003e` if its image is not allowed\") gets DOM XSS from attacker markup after `sanitize()` returns. It needs that kind of hook, so it falls under \"input plus an application choice\" in SECURITY.md, but it breaks the guarantee the README gives for hook detached nodes and is the same pattern as GHSA-55q2-fjhq-7xh7 and GHSA-p98j-92pf-mc4p.\n\n### Suggested fix\n\nInstead of only checking `currentNode`, check after each hook call whether anything outside the current node was detached. Two simple options:\n\n- before calling a hook in `IN_PLACE` mode, remember the next node the walker will visit and the current node's ancestors; after the hook, neutralize any of them that are no longer attached under `root`\n- or, after the walk, neutralize every element that was in the original tree but is no longer connected to `root` (for example by collecting the elements before the walk)", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-mrv2-3pqr-j5jr", "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "https://github.com/cure53/DOMPurify", "https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575", "https://github.com/cure53/DOMPurify/pull/1672", "https://github.com/cure53/DOMPurify/releases/tag/3.4.17", "https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr" ], "PublishedDate": "2026-10-22T16:24:52Z", "LastModifiedDate": "2026-10-22T16:24:52Z" }, { "VulnerabilityID": "CVE-2026-39356", "VendorIDs": [ "GHSA-gpj5-g38j-94v9" ], "PkgID": "drizzle-orm@0.45.1", "PkgName": "drizzle-orm", "PkgPath": "app/node_modules/.bun/drizzle-orm@0.45.1+22def57015774fd9/node_modules/drizzle-orm/package.json", "PkgIdentifier": { "PURL": "pkg:npm/drizzle-orm@0.45.1", "UID": "13ed531c5ff872db" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.45.2, 1.0.0-beta.20", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39356", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:677efa922a29d3836d62fc568029c124b2001ddfbc6143ca090302292e555509", "Title": "Drizzle ORM has SQL injection via improperly escaped SQL identifiers", "Description": "Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.", "Severity": "HIGH", "CweIDs": [ "CWE-89" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://github.com/drizzle-team/drizzle-orm", "https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9", "https://nvd.nist.gov/vuln/detail/CVE-2026-39356" ], "PublishedDate": "2026-04-07T20:16:29.61Z", "LastModifiedDate": "2026-07-20T20:10:00.11Z" }, { "VulnerabilityID": "CVE-2026-75899", "VendorIDs": [ "GHSA-fph4-wmhf-6fwf" ], "PkgID": "fast-uri@3.1.5", "PkgName": "fast-uri", "PkgPath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "PkgIdentifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "InstalledVersion": "3.1.5", "FixedVersion": "2.4.5, 3.1.6, 4.1.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75899", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:47c18853c4a6bad3bd617e6dc458eb0e4f0a71df1127b33c3d393448c959a13f", "Title": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding", "Description": "fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.", "Severity": "HIGH", "CweIDs": [ "CWE-174", "CWE-918" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71543", "https://access.redhat.com/security/cve/CVE-2026-75899", "https://advisory.echohq.com/cve/CVE-2026-75899", "https://bugzilla.redhat.com/2521778", "https://bugzilla.redhat.com/2521779", "https://bugzilla.redhat.com/2521798", "https://bugzilla.redhat.com/2527747", "https://bugzilla.redhat.com/show_bug.cgi?id=2521778", "https://bugzilla.redhat.com/show_bug.cgi?id=2521779", "https://bugzilla.redhat.com/show_bug.cgi?id=2521798", "https://bugzilla.redhat.com/show_bug.cgi?id=2527747", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84292", "https://errata.almalinux.org/10/ALSA-2026-71543.html", "https://errata.rockylinux.org/RLSA-2026:71543", "https://github.com/fastify/fast-uri", "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f", "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304", "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514", "https://github.com/fastify/fast-uri/releases/tag/v2.4.5", "https://github.com/fastify/fast-uri/releases/tag/v3.1.6", "https://github.com/fastify/fast-uri/releases/tag/v4.1.3", "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf", "https://linux.oracle.com/cve/CVE-2026-75899.html", "https://linux.oracle.com/errata/ELSA-2026-71543.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-75899", "https://www.cve.org/CVERecord?id=CVE-2026-75899" ], "PublishedDate": "2026-08-24T10:16:39.96Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2026-75931", "VendorIDs": [ "GHSA-5jgf-p345-68v8" ], "PkgID": "fast-uri@3.1.5", "PkgName": "fast-uri", "PkgPath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "PkgIdentifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "InstalledVersion": "3.1.5", "FixedVersion": "2.4.5, 3.1.6, 4.1.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75931", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:6d849a9bde9d27f680922fb0c646d7e55ceecdabac4ef80b8d50f42140d65e64", "Title": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization", "Description": "fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.", "Severity": "HIGH", "CweIDs": [ "CWE-436" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75931", "https://advisory.echohq.com/cve/CVE-2026-75931", "https://cna.openjsf.org/security-advisories.html", "https://github.com/fastify/fast-uri", "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5", "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef", "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3", "https://github.com/fastify/fast-uri/releases/tag/v2.4.5", "https://github.com/fastify/fast-uri/releases/tag/v3.1.6", "https://github.com/fastify/fast-uri/releases/tag/v4.1.3", "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8", "https://nvd.nist.gov/vuln/detail/CVE-2026-75931", "https://www.cve.org/CVERecord?id=CVE-2026-75931" ], "PublishedDate": "2026-08-24T10:16:40.113Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2026-75975", "VendorIDs": [ "GHSA-f65p-4m7j-42xc" ], "PkgID": "fast-uri@3.1.5", "PkgName": "fast-uri", "PkgPath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "PkgIdentifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "InstalledVersion": "3.1.5", "FixedVersion": "2.4.5, 3.1.6, 4.1.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75975", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:62bb184d0a5055020bf445f6bbebd43c39c7f9819d46cf51afe4e47f58e20afb", "Title": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization", "Description": "fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-918" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71543", "https://access.redhat.com/security/cve/CVE-2026-75975", "https://advisory.echohq.com/cve/CVE-2026-75975", "https://bugzilla.redhat.com/2521778", "https://bugzilla.redhat.com/2521779", "https://bugzilla.redhat.com/2521798", "https://bugzilla.redhat.com/2527747", "https://bugzilla.redhat.com/show_bug.cgi?id=2521778", "https://bugzilla.redhat.com/show_bug.cgi?id=2521779", "https://bugzilla.redhat.com/show_bug.cgi?id=2521798", "https://bugzilla.redhat.com/show_bug.cgi?id=2527747", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84292", "https://errata.almalinux.org/10/ALSA-2026-71543.html", "https://errata.rockylinux.org/RLSA-2026:71543", "https://github.com/fastify/fast-uri", "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595", "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f", "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799", "https://github.com/fastify/fast-uri/releases/tag/v2.4.5", "https://github.com/fastify/fast-uri/releases/tag/v3.1.6", "https://github.com/fastify/fast-uri/releases/tag/v4.1.3", "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc", "https://linux.oracle.com/cve/CVE-2026-75975.html", "https://linux.oracle.com/errata/ELSA-2026-71543.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-75975", "https://www.cve.org/CVERecord?id=CVE-2026-75975" ], "PublishedDate": "2026-08-24T10:16:40.237Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2026-76172", "VendorIDs": [ "GHSA-jqff-g426-hqxp" ], "PkgID": "fast-uri@3.1.5", "PkgName": "fast-uri", "PkgPath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "PkgIdentifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "InstalledVersion": "3.1.5", "FixedVersion": "2.4.5, 3.1.6, 4.1.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76172", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e10c37a563a4484d163098253275318bac14db873fcd4f3166726127a7643eff", "Title": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects", "Description": "fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.", "Severity": "HIGH", "CweIDs": [ "CWE-177" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71543", "https://access.redhat.com/security/cve/CVE-2026-76172", "https://advisory.echohq.com/cve/CVE-2026-76172", "https://bugzilla.redhat.com/2521778", "https://bugzilla.redhat.com/2521779", "https://bugzilla.redhat.com/2521798", "https://bugzilla.redhat.com/2527747", "https://bugzilla.redhat.com/show_bug.cgi?id=2521778", "https://bugzilla.redhat.com/show_bug.cgi?id=2521779", "https://bugzilla.redhat.com/show_bug.cgi?id=2521798", "https://bugzilla.redhat.com/show_bug.cgi?id=2527747", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84292", "https://errata.almalinux.org/10/ALSA-2026-71543.html", "https://errata.rockylinux.org/RLSA-2026:71543", "https://github.com/fastify/fast-uri", "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862", "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b", "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39", "https://github.com/fastify/fast-uri/releases/tag/v2.4.5", "https://github.com/fastify/fast-uri/releases/tag/v3.1.6", "https://github.com/fastify/fast-uri/releases/tag/v4.1.3", "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp", "https://linux.oracle.com/cve/CVE-2026-76172.html", "https://linux.oracle.com/errata/ELSA-2026-71543.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76172", "https://www.cve.org/CVERecord?id=CVE-2026-76172" ], "PublishedDate": "2026-08-24T11:16:40.723Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2026-84292", "VendorIDs": [ "GHSA-qw65-cvwx-89v3" ], "PkgID": "fast-uri@3.1.5", "PkgName": "fast-uri", "PkgPath": "app/node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/package.json", "PkgIdentifier": { "PURL": "pkg:npm/fast-uri@3.1.5", "UID": "d18e631cb454f67" }, "InstalledVersion": "3.1.5", "FixedVersion": "2.4.6, 3.1.7, 4.1.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84292", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:63c30706f945a40046d498077aeb6cdfe76c06a1d8790805c423596d3070ff86", "Title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization", "Description": "fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.", "Severity": "HIGH", "CweIDs": [ "CWE-116" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71543", "https://access.redhat.com/security/cve/CVE-2026-84292", "https://advisory.echohq.com/cve/CVE-2026-84292", "https://bugzilla.redhat.com/2521778", "https://bugzilla.redhat.com/2521779", "https://bugzilla.redhat.com/2521798", "https://bugzilla.redhat.com/2527747", "https://bugzilla.redhat.com/show_bug.cgi?id=2521778", "https://bugzilla.redhat.com/show_bug.cgi?id=2521779", "https://bugzilla.redhat.com/show_bug.cgi?id=2521798", "https://bugzilla.redhat.com/show_bug.cgi?id=2527747", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84292", "https://errata.almalinux.org/10/ALSA-2026-71543.html", "https://errata.rockylinux.org/RLSA-2026:71543", "https://github.com/fastify/fast-uri", "https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4", "https://github.com/fastify/fast-uri/releases/tag/v2.4.6", "https://github.com/fastify/fast-uri/releases/tag/v3.1.7", "https://github.com/fastify/fast-uri/releases/tag/v4.1.4", "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3", "https://linux.oracle.com/cve/CVE-2026-84292.html", "https://linux.oracle.com/errata/ELSA-2026-71543.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84292", "https://www.cve.org/CVERecord?id=CVE-2026-84292" ], "PublishedDate": "2026-09-02T20:17:39.543Z", "LastModifiedDate": "2026-10-06T22:10:00.247Z" }, { "VulnerabilityID": "CVE-2026-54290", "VendorIDs": [ "GHSA-88fw-hqm2-52qc" ], "PkgID": "hono@4.12.8", "PkgName": "hono", "PkgPath": "app/node_modules/.bun/hono@4.12.8/node_modules/hono/package.json", "PkgIdentifier": { "PURL": "pkg:npm/hono@4.12.8", "UID": "ec3033b8a3af68ab" }, "InstalledVersion": "4.12.8", "FixedVersion": "4.12.25", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54290", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:f63b197061b2bb620c6f256688d2ecdd1d7ba1a766f30b892c952745ee7c22ca", "Title": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard", "Description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.", "Severity": "HIGH", "CweIDs": [ "CWE-942" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-54290", "https://github.com/advisories/GHSA-88fw-hqm2-52qc", "https://github.com/honojs/hono", "https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-54290" ], "PublishedDate": "2026-06-22T18:16:47.62Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-44635", "VendorIDs": [ "GHSA-pv5w-4p9q-p3v2" ], "PkgID": "kysely@0.28.14", "PkgName": "kysely", "PkgPath": "app/node_modules/.bun/kysely@0.28.14/node_modules/kysely/package.json", "PkgIdentifier": { "PURL": "pkg:npm/kysely@0.28.14", "UID": "f488c800fec58ae6" }, "InstalledVersion": "0.28.14", "FixedVersion": "0.28.17", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44635", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:73800c785e27e3fce38fdf9f46bfb195a4ef51e409e692c6a61a66663dbd54cd", "Title": "Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`", "Description": "Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '-\u003e$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record\u003cstring, T\u003e so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL -\u003e$/-\u003e\u003e$, and SQLite. This vulnerability is fixed in 0.28.17.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-89", "CWE-915", "CWE-1284" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://github.com/kysely-org/kysely", "https://github.com/kysely-org/kysely/releases/tag/v0.28.17", "https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2", "https://nvd.nist.gov/vuln/detail/CVE-2026-44635" ], "PublishedDate": "2026-05-27T19:16:20.947Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67213", "VendorIDs": [ "GHSA-2v37-7h3g-55p8" ], "PkgID": "nanoid@3.3.11", "PkgName": "nanoid", "PkgPath": "app/node_modules/.bun/nanoid@3.3.11/node_modules/nanoid/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nanoid@3.3.11", "UID": "633d201c33d4c6a4" }, "InstalledVersion": "3.3.11", "FixedVersion": "3.3.18, 5.1.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67213", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:1c1622fbb98f7e318d5ec3350a8919497f482a507bc30fe7ebaa49ced8d29aae", "Title": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation", "Description": "nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 5.9, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67213", "https://advisory.echohq.com/cve/CVE-2026-67213", "https://github.com/ai/nanoid", "https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7", "https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0", "https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b", "https://github.com/ai/nanoid/releases/tag/3.3.17", "https://github.com/ai/nanoid/releases/tag/3.3.18", "https://github.com/ai/nanoid/releases/tag/5.1.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-67213", "https://www.cve.org/CVERecord?id=CVE-2026-67213", "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom" ], "PublishedDate": "2026-07-29T14:16:34.89Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67214", "VendorIDs": [ "GHSA-28wg-ghj8-5hjv" ], "PkgID": "nanoid@3.3.11", "PkgName": "nanoid", "PkgPath": "app/node_modules/.bun/nanoid@3.3.11/node_modules/nanoid/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nanoid@3.3.11", "UID": "633d201c33d4c6a4" }, "InstalledVersion": "3.3.11", "FixedVersion": "3.3.16, 5.1.16", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67214", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:8589de856bffc0c501e4c9b26865b9cb5703ba625d26a621ff3e1b29572f435c", "Title": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions", "Description": "nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 5.9, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67214", "https://advisory.echohq.com/cve/CVE-2026-67214", "https://github.com/ai/nanoid", "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49", "https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d", "https://github.com/ai/nanoid/pull/600", "https://github.com/ai/nanoid/pull/601", "https://github.com/ai/nanoid/releases/tag/3.3.16", "https://github.com/ai/nanoid/releases/tag/5.1.16", "https://nvd.nist.gov/vuln/detail/CVE-2026-67214", "https://www.cve.org/CVERecord?id=CVE-2026-67214", "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module" ], "PublishedDate": "2026-07-29T14:16:35.043Z", "LastModifiedDate": "2026-10-29T21:17:29.87Z" }, { "VulnerabilityID": "CVE-2026-73086", "VendorIDs": [ "GHSA-xwg4-73v4-xw9w" ], "PkgID": "nanoid@3.3.11", "PkgName": "nanoid", "PkgPath": "app/node_modules/.bun/nanoid@3.3.11/node_modules/nanoid/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nanoid@3.3.11", "UID": "633d201c33d4c6a4" }, "InstalledVersion": "3.3.11", "FixedVersion": "3.3.12, 5.1.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-73086", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:5ee72395d590f30a995d8e298cade9e5e166d32eabad4cf8e4e0615969cdc22b", "Title": "nanoid: nanoid: Predictable ID generation due to integer overflow", "Description": "nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-73086", "https://advisory.echohq.com/cve/CVE-2026-73086", "https://github.com/advisories/GHSA-xwg4-73v4-xw9w", "https://github.com/ai/nanoid", "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "https://github.com/ai/nanoid/releases/tag/3.3.12", "https://github.com/ai/nanoid/releases/tag/5.1.11", "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "https://nvd.nist.gov/vuln/detail/CVE-2026-73086", "https://www.cve.org/CVERecord?id=CVE-2026-73086" ], "PublishedDate": "2026-08-11T17:19:16.69Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2025-14874", "VendorIDs": [ "GHSA-rcmh-qjqh-p98v" ], "PkgID": "nodemailer@6.10.1", "PkgName": "nodemailer", "PkgPath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "InstalledVersion": "6.10.1", "FixedVersion": "7.0.11", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14874", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:7db8ccc2350ce032e5d477fbb969821b6d5cb827db05a205cc3a02240ea7e869", "Title": "nodemailer: Nodemailer: Denial of service via crafted email address header", "Description": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.", "Severity": "HIGH", "CweIDs": [ "CWE-703" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-14874", "https://advisory.echohq.com/cve/CVE-2025-14874", "https://bugzilla.redhat.com/show_bug.cgi?id=2418133", "https://github.com/advisories/GHSA-rcmh-qjqh-p98v", "https://github.com/nodemailer/nodemailer", "https://github.com/nodemailer/nodemailer/commit/6218b8df", "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150", "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v", "https://nvd.nist.gov/vuln/detail/CVE-2025-14874", "https://www.cve.org/CVERecord?id=CVE-2025-14874" ], "PublishedDate": "2025-12-18T09:15:44.87Z", "LastModifiedDate": "2026-10-27T05:16:55.207Z" }, { "VulnerabilityID": "CVE-2026-82659", "VendorIDs": [ "GHSA-p6gq-j5cr-w38f" ], "PkgID": "nodemailer@6.10.1", "PkgName": "nodemailer", "PkgPath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "InstalledVersion": "6.10.1", "FixedVersion": "9.0.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-82659", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:2377d031a936d29acc659c442b9db5a454e13fdbd6820b1a191f7acc8c81d400", "Title": "nodemailer: Nodemailer: Arbitrary file read and Server-Side Request Forgery via raw option bypass", "Description": "nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.", "Severity": "HIGH", "CweIDs": [ "CWE-73" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-82659", "https://advisory.echohq.com/cve/CVE-2026-82659", "https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-68x8-4h5v-r533", "https://github.com/advisories/GHSA-p6gq-j5cr-w38f", "https://github.com/nodemailer/nodemailer", "https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2", "https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1", "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f", "https://nvd.nist.gov/vuln/detail/CVE-2026-82659", "https://www.cve.org/CVERecord?id=CVE-2026-82659", "https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option" ], "PublishedDate": "2026-08-31T09:17:03.633Z", "LastModifiedDate": "2026-09-10T15:48:28.757Z" }, { "VulnerabilityID": "CVE-2026-82662", "VendorIDs": [ "GHSA-r7g4-qg5f-qqm2" ], "PkgID": "nodemailer@6.10.1", "PkgName": "nodemailer", "PkgPath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "InstalledVersion": "6.10.1", "FixedVersion": "8.0.8", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-82662", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:16cb26c71a77195897807acb813e4c6de09d0767a924fa7a9fede63485f3770d", "Title": "nodemailer: Nodemailer: Information disclosure due to disabled TLS certificate verification", "Description": "Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "V3Score": 6.5, "V40Score": 8.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-82662", "https://advisory.echohq.com/cve/CVE-2026-82662", "https://github.com/advisories/GHSA-r7g4-qg5f-qqm2", "https://github.com/nodemailer/nodemailer", "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2", "https://nvd.nist.gov/vuln/detail/CVE-2026-82662", "https://www.cve.org/CVERecord?id=CVE-2026-82662", "https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass" ], "PublishedDate": "2026-08-31T09:17:04.093Z", "LastModifiedDate": "2026-09-10T15:48:28.757Z" }, { "VulnerabilityID": "GHSA-2x7j-588g-ccc2", "PkgID": "nodemailer@6.10.1", "PkgName": "nodemailer", "PkgPath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "InstalledVersion": "6.10.1", "FixedVersion": "9.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-2x7j-588g-ccc2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:86806942e27629105206c2a3d11f47132f2d53affbbc737260fd6e29945089b2", "Title": "Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list", "Description": "### Summary\n\nNodemailer's address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply‑To` value, or any value passed to the exported `addressparser`) therefore consumes CPU proportional to the **square** of its length and blocks Node's single‑threaded event loop for the entire duration, denying service to every other request in the process.\n\nThis requires **no special application configuration and no cooperating receiver** — it is entirely inside the parser and triggers on the library's default code path. A ~1.5 MB address value freezes the process for ~25–30 seconds of 100% CPU; the cost grows with the square of the input, so a few‑MB value stalls the server for minutes. It is a distinct issue from the recursion DoS fixed as CVE‑2025‑14874 (that path is guarded by a nesting‑depth cap; this one is a flat, comma‑separated list with no such limit).\n\n### Details\n\n`addressparser` tokenizes the input, splits it into per‑address token groups, and then accumulates the parsed results in a loop (`lib/addressparser/index.js`, ~lines 500–505):\n\n```js\naddresses.forEach(addr =\u003e {\n const handled = _handleAddress(addr, depth);\n if (handled.length) {\n parsedAddresses = parsedAddresses.concat(handled); // \u003c-- line ~503\n }\n});\n```\n\n`Array.prototype.concat` builds and returns a **new** array containing a copy of every element accumulated so far. Reassigning `parsedAddresses = parsedAddresses.concat(handled)` on each of the *n* iterations copies 1 + 2 + 3 + … + n elements in total, i.e. **O(n²)** work (and O(n²) transient allocations) for an input containing *n* addresses. Tokenization and `_handleAddress` themselves are linear; the quadratic blowup is entirely this accumulator.\n\n**Root‑cause proof.** Replacing only that line with an in‑place append and re‑running the exact same input:\n\n```\nparsedAddresses = parsedAddresses.concat(handled); -\u003e 100000 addresses: ~6068 ms\nparsedAddresses.push.apply(parsedAddresses, handled); -\u003e 100000 addresses: ~51 ms (≈119x faster, now linear)\n```\n\n**Measured scaling** (nodemailer 9.0.6, `'a@b.com,'.repeat(n)`):\n\n| addresses n | input size | parse time | ratio for 2× input |\n|---|---|---|---|\n| 25,000 | 0.19 MB | ~0.35 s | – |\n| 50,000 | 0.38 MB | ~1.4 s | ×4.0 |\n| 100,000 | 0.76 MB | ~6–8 s | ×3.9 |\n| 200,000 | 1.53 MB | ~25–30 s| ×4.1 |\n\nDoubling the input quadruples the time — the signature of O(n²).\n\n**Reachability.** The parser is invoked on any structured‑address header value on the normal send path (`MimeNode.setHeader('To'/'Cc'/'Bcc'/'From'/'Reply-To', value)` → `_parseAddresses` → `addressparser`, and `getEnvelope()`), so a single `transport.sendMail({ to: \u003ccrafted string\u003e })` triggers it. It is also reached directly through the **exported** `require('nodemailer/lib/addressparser')`, which many applications call to validate or display user‑supplied recipient lists. Confirmed via the public API: `setHeader('To', 'a@b.com,'.repeat(80000))` + `getEnvelope()` blocks for ~3.9 s.\n\n**Suggested fix:** accumulate in place instead of rebuilding the array each iteration, e.g. `parsedAddresses.push.apply(parsedAddresses, handled);` (or `for (const h of handled) parsedAddresses.push(h);`). Optionally cap the number of addresses / input length before parsing.\n\n### PoC\n\nEnvironment: Node.js ≥ 18 and the published `nodemailer@9.0.6`. No transport, network, or configuration required — the cost is in parsing.\n\n`poc-dos.js`:\n```js\n'use strict';\nconst addressparser = require('nodemailer/lib/addressparser');\n\nconsole.log('addresses | input size | parse time');\nfor (const n of [25000, 50000, 100000, 200000]) {\n const payload = 'a@b.com,'.repeat(n); // n valid, comma-separated recipients\n const t0 = process.hrtime.bigint();\n addressparser(payload); // blocks synchronously\n const ms = Number(process.hrtime.bigint() - t0) / 1e6;\n console.log(String(n).padStart(9) + ' | ' + (payload.length / 1048576).toFixed(2) + ' MB | ' + ms.toFixed(0).padStart(7) + ' ms');\n}\n```\n\nRun:\n```\nnpm init -y \u0026\u0026 npm install nodemailer@9.0.6\nnode poc-dos.js\n```\n\nActual output (nodemailer 9.0.6):\n```\naddresses | input size | parse time\n 25000 | 0.19 MB | 381 ms\n 50000 | 0.38 MB | 1435 ms\n 100000 | 0.76 MB | 7949 ms\n 200000 | 1.53 MB | 25154 ms\n```\n\nEquivalent trigger through the normal send API (freezes the event loop):\n```js\nconst nodemailer = require('nodemailer');\nnodemailer.createTransport({ jsonTransport: true })\n .sendMail({ from: 'a@b.com', to: 'a@b.com,'.repeat(150000), subject: 'x', text: 'y' });\n// ~15+ seconds of 100% CPU inside addressparser before anything is sent\n```\n\n### Impact\n\n* **Who is impacted:** any service that runs Nodemailer (or the standalone `nodemailer/lib/addressparser`) on an address value that can be influenced by an untrusted party — a recipient field in a \"send email / invite / share\" feature, a `Reply‑To`/`From` derived from user input, a contact‑import or mailing‑list parser, or any endpoint that validates addresses with `addressparser`. No authentication, special option, or particular receiver is needed.\n\n## Patched in 9.1.0\n\nThree separate quadratic paths were fixed, not one:\n\n* `addressparser` rebuilt its accumulator with `concat()` on every address ([9116da9](https://github.com/nodemailer/nodemailer/commit/9116da9)).\n* The display-name merge loop directly below spliced each fragment out of the array, the same shape reached through `'a, b \u003cc@d.com\u003e,'.repeat(n)` (same commit).\n* `MimeNode#_convertAddresses` checked recipient uniqueness with a linear scan per address ([7cc38af](https://github.com/nodemailer/nodemailer/commit/7cc38af), refined in [34da642](https://github.com/nodemailer/nodemailer/commit/34da642)). This was the most severe of the three and the reported proof of concept did not reach it: `'a@b.com,'.repeat(n)` is one address repeated, which dedupes to a single envelope entry. A list of *distinct* recipients cost O(n^2) here, taking ~35s for 100k even after `addressparser` was fixed.\n\nFixed alongside: `[].concat.apply` in `_parseAddresses` threw `RangeError: Maximum call stack size exceeded` past roughly 124k recipients, with no crafted input needed ([83b8c48](https://github.com/nodemailer/nodemailer/commit/83b8c48)).\n\nParsing 200k addresses now takes ~80ms instead of ~25s, and every path scales linearly. A new `maxRecipients` option (default 100000) throws rather than truncating, as a backstop.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-2x7j-588g-ccc2", "https://github.com/advisories/GHSA-2x7j-588g-ccc2", "https://github.com/nodemailer/nodemailer", "https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150", "https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e", "https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434", "https://github.com/nodemailer/nodemailer/pull/1848", "https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0", "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2" ], "PublishedDate": "2026-09-08T21:33:17Z", "LastModifiedDate": "2026-09-08T21:33:17Z" }, { "VulnerabilityID": "GHSA-v53p-9fqp-m79j", "PkgID": "nodemailer@6.10.1", "PkgName": "nodemailer", "PkgPath": "app/node_modules/.bun/nodemailer@6.10.1/node_modules/nodemailer/package.json", "PkgIdentifier": { "PURL": "pkg:npm/nodemailer@6.10.1", "UID": "4aceaf52b4ed1a07" }, "InstalledVersion": "6.10.1", "FixedVersion": "10.0.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-v53p-9fqp-m79j", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:3d0b100555d4c82fe4b473b972434dfe0642764b06542966fe78ac8615c68808", "Title": "Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service", "Description": "### Summary\n\nWhen `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\\s*\\b[^@\\s]+@[^\\s]+\\b\\s*/`. That pattern backtracks quadratically: `[^@\\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header value holding a long whitespace-free run with no usable `@` blocks the Node.js event loop for tens of seconds.\n\nIt is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.\n\n### Details\n\nThe fallback in `src/addressparser/index.ts` ran the pattern as a search. `[^@\\s]+` crosses neither whitespace nor `@`, so from each start offset it scans forward to the next `@` or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:\n\n- the run holds no `@` at all\n- the only `@` has nothing after it\n- the only `@` has nothing before it\n\nA fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.\n\n### PoC\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconst s = Date.now();\naddressparser(' \u003e' + '\u003e[x][x]'.repeat(40000)); // 273KB\nconsole.log(Date.now() - s, 'ms'); // ~43000 ms, blocking\n```\n\nMeasured on 10.0.5:\n\n| Value | Parse time |\n| --- | --- |\n| `'[x]'.repeat(40000)` (117KB) | 9.0 s |\n| `'[x]'.repeat(40000) + '@'` (117KB) | 8.9 s |\n| `'@' + '[x]'.repeat(40000)` (117KB) | 8.8 s |\n| `' \u003e' + '\u003e[x][x]'.repeat(40000)` (273KB) | 42.9 s |\n\n### Impact\n\nAlgorithmic-complexity denial of service. Node is single threaded, so the block stalls the whole process. Reachable without authentication anywhere inbound header values are handed to this parser, mailparser being the notable case, and reachable from application input wherever a user-supplied string is used as a message address, since `mime-node` parses `to`, `from` and `cc` when composing.\n\n### Patch\n\nThe search is replaced by a single linear pass that finds the one offset the pattern can match at, which is then applied there with a sticky regex. Match results are unchanged, verified against the previous implementation over 3.4 million random strings comparing both the match offset and the matched text, plus 800k full-parse comparisons.\n\nFound while validating the report in GHSA-prgh-xp8r-p3m5, not reported externally.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-v53p-9fqp-m79j", "https://github.com/advisories/GHSA-v53p-9fqp-m79j", "https://github.com/nodemailer/nodemailer", "https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102", "https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6", "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j" ], "PublishedDate": "2026-09-29T23:43:36Z", "LastModifiedDate": "2026-09-29T23:43:36Z" }, { "VulnerabilityID": "CVE-2026-33671", "VendorIDs": [ "GHSA-c2c7-rcm5-vvqj" ], "PkgID": "picomatch@2.3.1", "PkgName": "picomatch", "PkgPath": "app/node_modules/.bun/picomatch@2.3.1/node_modules/picomatch/package.json", "PkgIdentifier": { "PURL": "pkg:npm/picomatch@2.3.1", "UID": "38b6bd8a897b645a" }, "InstalledVersion": "2.3.1", "FixedVersion": "4.0.4, 3.0.2, 2.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33671", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:a8bd6cf91c7d62db5769d6ac13673f6c6d4e9f303905738ea0355f2606fcacf4", "Title": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns", "Description": "Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-33671", "https://github.com/micromatch/picomatch", "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "https://nvd.nist.gov/vuln/detail/CVE-2026-33671", "https://www.cve.org/CVERecord?id=CVE-2026-33671" ], "PublishedDate": "2026-03-26T22:16:30.21Z", "LastModifiedDate": "2026-06-17T10:37:54.007Z" }, { "VulnerabilityID": "CVE-2026-33671", "VendorIDs": [ "GHSA-c2c7-rcm5-vvqj" ], "PkgID": "picomatch@4.0.3", "PkgName": "picomatch", "PkgPath": "app/node_modules/.bun/picomatch@4.0.3/node_modules/picomatch/package.json", "PkgIdentifier": { "PURL": "pkg:npm/picomatch@4.0.3", "UID": "3e9097194133d28d" }, "InstalledVersion": "4.0.3", "FixedVersion": "4.0.4, 3.0.2, 2.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33671", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:6f1dd68c6eea9ef65dd9626f94485d533b1a9008a4f116133e3695720868fd09", "Title": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns", "Description": "Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-33671", "https://github.com/micromatch/picomatch", "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "https://nvd.nist.gov/vuln/detail/CVE-2026-33671", "https://www.cve.org/CVERecord?id=CVE-2026-33671" ], "PublishedDate": "2026-03-26T22:16:30.21Z", "LastModifiedDate": "2026-06-17T10:37:54.007Z" }, { "VulnerabilityID": "CVE-2026-45623", "VendorIDs": [ "GHSA-6g55-p6wh-862q" ], "PkgID": "postcss@8.5.8", "PkgName": "postcss", "PkgPath": "app/node_modules/.bun/postcss@8.5.8/node_modules/postcss/package.json", "PkgIdentifier": { "PURL": "pkg:npm/postcss@8.5.8", "UID": "7698fa5f82038eff" }, "InstalledVersion": "8.5.8", "FixedVersion": "8.5.12", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45623", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:fbf5e104aa8f14a3ed8f54833919e4c4640ef0175ca35192e7f48c4e6faf7bfd", "Title": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input", "Description": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-200" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45623", "https://advisory.echohq.com/cve/CVE-2026-45623", "https://github.com/advisories/GHSA-6g55-p6wh-862q", "https://github.com/postcss/postcss", "https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad", "https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3", "https://github.com/postcss/postcss/releases/tag/8.5.12", "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q", "https://nvd.nist.gov/vuln/detail/CVE-2026-45623", "https://www.cve.org/CVERecord?id=CVE-2026-45623" ], "PublishedDate": "2026-07-27T18:16:55.13Z", "LastModifiedDate": "2026-08-07T00:13:41.957Z" }, { "VulnerabilityID": "CVE-2026-73646", "VendorIDs": [ "GHSA-r28c-9q8g-f849" ], "PkgID": "postcss@8.5.8", "PkgName": "postcss", "PkgPath": "app/node_modules/.bun/postcss@8.5.8/node_modules/postcss/package.json", "PkgIdentifier": { "PURL": "pkg:npm/postcss@8.5.8", "UID": "7698fa5f82038eff" }, "InstalledVersion": "8.5.8", "FixedVersion": "8.5.18", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-73646", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:136dc54c6654c68c638ac64bf613dad44bfbf84e6fa7b55501d0480b09dd11b0", "Title": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading", "Description": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-73646", "https://advisory.echohq.com/cve/CVE-2026-73646", "https://github.com/postcss/postcss", "https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c", "https://github.com/postcss/postcss/releases/tag/8.5.18", "https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849", "https://nvd.nist.gov/vuln/detail/CVE-2026-73646", "https://www.cve.org/CVERecord?id=CVE-2026-73646" ], "PublishedDate": "2026-08-17T16:17:47.257Z", "LastModifiedDate": "2026-09-18T20:05:53.723Z" }, { "VulnerabilityID": "CVE-2026-104847", "VendorIDs": [ "GHSA-c8x8-7fp4-3x9w" ], "PkgID": "prosemirror-view@1.42.2", "PkgName": "prosemirror-view", "PkgPath": "app/node_modules/.bun/prosemirror-view@1.42.2/node_modules/prosemirror-view/package.json", "PkgIdentifier": { "PURL": "pkg:npm/prosemirror-view@1.42.2", "UID": "ada21626476c2729" }, "InstalledVersion": "1.42.2", "FixedVersion": "1.42.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-104847", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b233e2d432f9793dbd79aba1c60dc64f71577888fee38031e65801e76b903d13", "Title": "ProseMirror has a XSS vulnerability in prosemirror-view's paste handling", "Description": "ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.5 } }, "References": [ "https://advisory.echohq.com/cve/CVE-2026-104847", "https://github.com/ProseMirror/prosemirror-view", "https://github.com/ProseMirror/prosemirror-view/commit/20dc0a911a79f8fc6640dbbea5e7d68d3c4784b7", "https://github.com/ProseMirror/prosemirror-view/commit/2e91a612bbc1248e55b4f6061fc93fe459f977c1", "https://github.com/ProseMirror/prosemirror-view/security/advisories/GHSA-c8x8-7fp4-3x9w", "https://github.com/advisories/GHSA-c8x8-7fp4-3x9w", "https://nvd.nist.gov/vuln/detail/CVE-2026-104847" ], "PublishedDate": "2026-10-02T16:16:47.41Z", "LastModifiedDate": "2026-10-02T18:44:11.27Z" }, { "VulnerabilityID": "CVE-2026-44289", "VendorIDs": [ "GHSA-685m-2w69-288q" ], "PkgID": "protobufjs@7.5.5", "PkgName": "protobufjs", "PkgPath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "PkgIdentifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "InstalledVersion": "7.5.5", "FixedVersion": "7.5.6, 8.0.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44289", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:9fe891db85b90dbd34374758928c6c666d5df69216dfe728cf121a6b4b2f6118", "Title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding", "Description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-606" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42815", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/security/cve/CVE-2026-44289", "https://advisory.echohq.com/cve/CVE-2026-44289", "https://bugzilla.redhat.com/show_bug.cgi?id=2477130", "https://github.com/advisories/GHSA-685m-2w69-288q", "https://github.com/protobufjs/protobuf.js", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2", "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q", "https://nvd.nist.gov/vuln/detail/CVE-2026-44289", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44289.json", "https://www.cve.org/CVERecord?id=CVE-2026-44289" ], "PublishedDate": "2026-05-13T16:16:55.713Z", "LastModifiedDate": "2026-08-28T16:18:02.453Z" }, { "VulnerabilityID": "CVE-2026-44290", "VendorIDs": [ "GHSA-jvwf-75h9-cwgg" ], "PkgID": "protobufjs@7.5.5", "PkgName": "protobufjs", "PkgPath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "PkgIdentifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "InstalledVersion": "7.5.5", "FixedVersion": "7.5.6, 8.0.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44290", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:01746c30c2af162a7b1d6f1642eadb81616ce799b810384bd394af9cf3aaaa8d", "Title": "protobufjs: protobufjs: Denial of Service via crafted schema", "Description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.", "Severity": "HIGH", "CweIDs": [ "CWE-1321" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44290", "https://advisory.echohq.com/cve/CVE-2026-44290", "https://github.com/advisories/GHSA-jvwf-75h9-cwgg", "https://github.com/protobufjs/protobuf.js", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2", "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg", "https://nvd.nist.gov/vuln/detail/CVE-2026-44290", "https://www.cve.org/CVERecord?id=CVE-2026-44290" ], "PublishedDate": "2026-05-13T16:16:55.847Z", "LastModifiedDate": "2026-06-17T10:50:27.12Z" }, { "VulnerabilityID": "CVE-2026-44291", "VendorIDs": [ "GHSA-75px-5xx7-5xc7" ], "PkgID": "protobufjs@7.5.5", "PkgName": "protobufjs", "PkgPath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "PkgIdentifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "InstalledVersion": "7.5.5", "FixedVersion": "7.5.6, 8.0.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44291", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:fd0bc66c65460948abf376e8803c9e9f6717e6fe0f7427402411f7232435b7c1", "Title": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution", "Description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44291", "https://advisory.echohq.com/cve/CVE-2026-44291", "https://github.com/advisories/GHSA-75px-5xx7-5xc7", "https://github.com/protobufjs/protobuf.js", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2", "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7", "https://nvd.nist.gov/vuln/detail/CVE-2026-44291", "https://www.cve.org/CVERecord?id=CVE-2026-44291" ], "PublishedDate": "2026-05-13T16:16:55.987Z", "LastModifiedDate": "2026-06-17T10:50:27.223Z" }, { "VulnerabilityID": "CVE-2026-44293", "VendorIDs": [ "GHSA-66ff-xgx4-vchm" ], "PkgID": "protobufjs@7.5.5", "PkgName": "protobufjs", "PkgPath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "PkgIdentifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "InstalledVersion": "7.5.5", "FixedVersion": "7.5.6, 8.0.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44293", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:789e27a46f5f36b7e572ac418450a651cb2df1ac1dba4097e5572be9fdb8c081", "Title": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors", "Description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26090", "https://access.redhat.com/errata/RHSA-2026:26234", "https://access.redhat.com/errata/RHSA-2026:29795", "https://access.redhat.com/errata/RHSA-2026:34160", "https://access.redhat.com/errata/RHSA-2026:34374", "https://access.redhat.com/errata/RHSA-2026:37186", "https://access.redhat.com/errata/RHSA-2026:37385", "https://access.redhat.com/errata/RHSA-2026:37628", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/security/cve/CVE-2026-44293", "https://advisory.echohq.com/cve/CVE-2026-44293", "https://bugzilla.redhat.com/show_bug.cgi?id=2477104", "https://github.com/advisories/GHSA-66ff-xgx4-vchm", "https://github.com/protobufjs/protobuf.js", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6", "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2", "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm", "https://nvd.nist.gov/vuln/detail/CVE-2026-44293", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44293.json", "https://www.cve.org/CVERecord?id=CVE-2026-44293" ], "PublishedDate": "2026-05-13T16:16:56.253Z", "LastModifiedDate": "2026-09-09T13:20:07.537Z" }, { "VulnerabilityID": "CVE-2026-48712", "VendorIDs": [ "GHSA-wcpc-wj8m-hjx6" ], "PkgID": "protobufjs@7.5.5", "PkgName": "protobufjs", "PkgPath": "app/node_modules/.bun/protobufjs@7.5.5/node_modules/protobufjs/package.json", "PkgIdentifier": { "PURL": "pkg:npm/protobufjs@7.5.5", "UID": "2988d9c50f5b6385" }, "InstalledVersion": "7.5.5", "FixedVersion": "7.6.1, 8.4.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48712", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:6e506db663b05b40a75f0b555ab1a1ebb51a177e3cada15e06792cbcd3b32cba", "Title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload", "Description": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-48712", "https://advisory.echohq.com/cve/CVE-2026-48712", "https://github.com/advisories/GHSA-wcpc-wj8m-hjx6", "https://github.com/protobufjs/protobuf.js", "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6", "https://nvd.nist.gov/vuln/detail/CVE-2026-48712", "https://www.cve.org/CVERecord?id=CVE-2026-48712" ], "PublishedDate": "2026-06-22T18:16:39.64Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-90711", "VendorIDs": [ "GHSA-jqcg-44mw-7w3h" ], "PkgID": "proxy-addr@2.0.7", "PkgName": "proxy-addr", "PkgPath": "app/node_modules/.bun/proxy-addr@2.0.7/node_modules/proxy-addr/package.json", "PkgIdentifier": { "PURL": "pkg:npm/proxy-addr@2.0.7", "UID": "65cdc6facf143eb3" }, "InstalledVersion": "2.0.7", "FixedVersion": "2.0.8", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90711", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:a6bc7521e5ef1e4f4c8776c99e3e403e066b829b68350aea009678ed0e5cf587", "Title": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet", "Description": "proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.", "Severity": "CRITICAL", "CweIDs": [ "CWE-290", "CWE-348", "CWE-697" ], "VendorSeverity": { "ghsa": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90711", "https://advisory.echohq.com/cve/CVE-2026-90711", "https://cna.openjsf.org/security-advisories.html", "https://github.com/jshttp/proxy-addr", "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8", "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "https://nvd.nist.gov/vuln/detail/CVE-2026-90711", "https://www.cve.org/CVERecord?id=CVE-2026-90711" ], "PublishedDate": "2026-09-15T07:16:33.683Z", "LastModifiedDate": "2026-09-16T19:40:00.317Z" }, { "VulnerabilityID": "CVE-2026-104846", "VendorIDs": [ "GHSA-p6vx-979v-rg4c" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.6.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-104846", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:1c54c370e5adb0eef6574d79e3934ba0183b4c103bbed78cd8046db1faa5a4f5", "Title": "seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)", "Description": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.", "Severity": "CRITICAL", "CweIDs": [ "CWE-843" ], "VendorSeverity": { "ghsa": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-104846", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-104846", "https://www.cve.org/CVERecord?id=CVE-2026-104846" ], "PublishedDate": "2026-10-02T16:16:47.23Z", "LastModifiedDate": "2026-10-05T21:16:32.78Z" }, { "VulnerabilityID": "CVE-2026-59940", "VendorIDs": [ "GHSA-mv8w-475r-vwqw" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.5.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59940", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ad74a31b9d594f034306802b2575877853a2fb4b44cb43745b3cf0aeff1f7363", "Title": "seroval: Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization", "Description": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.", "Severity": "CRITICAL", "CweIDs": [ "CWE-502", "CWE-843" ], "VendorSeverity": { "ghsa": 4, "redhat": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59940", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw", "https://nvd.nist.gov/vuln/detail/CVE-2026-59940", "https://www.cve.org/CVERecord?id=CVE-2026-59940", "https://www.npmjs.com/package/seroval/v/1.5.3" ], "PublishedDate": "2026-08-18T15:16:56.007Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-104845", "VendorIDs": [ "GHSA-jp82-f5mq-hwhp" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.6.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-104845", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:6de551c89d7e6e686caceac829672e4d9549d31037766969e3ec5e68391211e5", "Title": "seroval: seroval: Denial of Service via unbounded memory allocation during deserialization", "Description": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-104845", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/commit/ac0163e420ac7dcbbefac4d069bcefad300a4851", "https://github.com/lxsmnsyc/seroval/commit/e54a6f62784b9e48e3a5fa2ab4089ca69fb8996e", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-jp82-f5mq-hwhp", "https://nvd.nist.gov/vuln/detail/CVE-2026-104845", "https://www.cve.org/CVERecord?id=CVE-2026-104845" ], "PublishedDate": "2026-10-02T16:16:47.07Z", "LastModifiedDate": "2026-10-06T17:17:15.587Z" }, { "VulnerabilityID": "CVE-2026-116580", "VendorIDs": [ "GHSA-7rv5-mrxv-xcr9" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.6.8", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116580", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:91cb2194f400cfb9e613d6e3570b329a908f4e191cae9398261cf0a9cbf3e7d8", "Title": "seroval: seroval: Unintended function execution via crafted serialized input", "Description": "Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.", "Severity": "HIGH", "CweIDs": [ "CWE-502" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116580", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2", "https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d", "https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9", "https://nvd.nist.gov/vuln/detail/CVE-2026-116580", "https://www.cve.org/CVERecord?id=CVE-2026-116580" ], "PublishedDate": "2026-10-26T21:18:15.523Z", "LastModifiedDate": "2026-11-02T19:17:56.16Z" }, { "VulnerabilityID": "CVE-2026-116581", "VendorIDs": [ "GHSA-97r2-qh9m-474h" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.6.8", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116581", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:9f08395a5b481ff002d9f0a024a3a5c0e72e1ec77ae81840f24498e103d77ff9", "Title": "seroval: seroval: Denial of Service via crafted sequence node during deserialization", "Description": "Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-1284" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116581", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69", "https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728", "https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h", "https://nvd.nist.gov/vuln/detail/CVE-2026-116581", "https://www.cve.org/CVERecord?id=CVE-2026-116581" ], "PublishedDate": "2026-10-26T21:18:15.903Z", "LastModifiedDate": "2026-10-31T02:17:33.007Z" }, { "VulnerabilityID": "CVE-2026-116584", "VendorIDs": [ "GHSA-wp97-x4hv-qvhp" ], "PkgID": "seroval@1.5.1", "PkgName": "seroval", "PkgPath": "app/node_modules/.bun/seroval@1.5.1/node_modules/seroval/package.json", "PkgIdentifier": { "PURL": "pkg:npm/seroval@1.5.1", "UID": "df93170ad484d470" }, "InstalledVersion": "1.5.1", "FixedVersion": "1.6.8", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116584", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:0af23c22437651858a3c3b65541d7e5dd7f546616ef715b1ee868cd89b0b3f14", "Title": "seroval: seroval: Denial of Service via manipulated array length during deserialization", "Description": "Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116584", "https://github.com/lxsmnsyc/seroval", "https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69", "https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8", "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp", "https://nvd.nist.gov/vuln/detail/CVE-2026-116584", "https://www.cve.org/CVERecord?id=CVE-2026-116584" ], "PublishedDate": "2026-10-26T21:18:17.053Z", "LastModifiedDate": "2026-11-02T19:17:56.29Z" }, { "VulnerabilityID": "CVE-2026-93749", "VendorIDs": [ "GHSA-68fv-2mgg-jv7q" ], "PkgID": "source-map-js@1.2.1", "PkgName": "source-map-js", "PkgPath": "app/node_modules/.bun/source-map-js@1.2.1/node_modules/source-map-js/package.json", "PkgIdentifier": { "PURL": "pkg:npm/source-map-js@1.2.1", "UID": "c52b62c3fb132e01" }, "InstalledVersion": "1.2.1", "FixedVersion": "1.2.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93749", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e623f7b9ae7927b8071ff2b0ed3d5bc742f8553a339a4a52b360b84f6620230b", "Title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps", "Description": "source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.", "Severity": "HIGH", "CweIDs": [ "CWE-1284" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-93749", "https://advisory.echohq.com/cve/CVE-2026-93749", "https://github.com/7rulnik/source-map-js", "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118", "https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016", "https://github.com/7rulnik/source-map-js/issues/76", "https://github.com/7rulnik/source-map-js/pull/79", "https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2", "https://nvd.nist.gov/vuln/detail/CVE-2026-93749", "https://www.cve.org/CVERecord?id=CVE-2026-93749", "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service" ], "PublishedDate": "2026-09-18T18:18:33.48Z", "LastModifiedDate": "2026-09-22T20:25:55.87Z" }, { "VulnerabilityID": "CVE-2026-44705", "VendorIDs": [ "GHSA-ph9p-34f9-6g65" ], "PkgID": "tmp@0.2.5", "PkgName": "tmp", "PkgPath": "app/node_modules/.bun/tmp@0.2.5/node_modules/tmp/package.json", "PkgIdentifier": { "PURL": "pkg:npm/tmp@0.2.5", "UID": "b5fa317dd5805851" }, "InstalledVersion": "0.2.5", "FixedVersion": "0.2.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44705", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:03fe97d415f4f5ed875d39890be6e51437299651679935d26c14450c62535d27", "Title": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape", "Description": "tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44705", "https://advisory.echohq.com/cve/CVE-2026-44705", "https://github.com/advisories/GHSA-ph9p-34f9-6g65", "https://github.com/raszi/node-tmp", "https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429", "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65", "https://nvd.nist.gov/vuln/detail/CVE-2026-44705", "https://www.cve.org/CVERecord?id=CVE-2026-44705" ], "PublishedDate": "2026-06-11T17:16:33.853Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-109383", "VendorIDs": [ "GHSA-2m5v-pch6-74hx" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109383", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:892754091e4d7235a76acd866dc7f87cfa6ceebf6e878665079c1cd43cb7a717", "Title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "Description": "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109383", "https://advisory.echohq.com/cve/CVE-2026-109383", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4", "https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f", "https://github.com/nodejs/undici/commit/f75eac00ac17", "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx", "https://nvd.nist.gov/vuln/detail/CVE-2026-109383", "https://www.cve.org/CVERecord?id=CVE-2026-109383" ], "PublishedDate": "2026-10-15T19:17:20.853Z", "LastModifiedDate": "2026-10-19T20:45:52.41Z" }, { "VulnerabilityID": "CVE-2026-109829", "VendorIDs": [ "GHSA-4w7w-5xrc-9h26" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109829", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ad6bb901c677e5eda018362658c463bb9f0ba0de95aa3b5ccbf0ed33ab1fad88", "Title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "Description": "undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-524" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109829", "https://advisory.echohq.com/cve/CVE-2026-109829", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/26c2bfb3def0", "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8", "https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26", "https://nvd.nist.gov/vuln/detail/CVE-2026-109829", "https://www.cve.org/CVERecord?id=CVE-2026-109829" ], "PublishedDate": "2026-10-15T19:17:21.513Z", "LastModifiedDate": "2026-10-19T20:45:43.39Z" }, { "VulnerabilityID": "CVE-2026-109869", "VendorIDs": [ "GHSA-xjj6-f33q-929c" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109869", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:9540ec70d1e9f611e1a4f9a9f2d7273b76543119bc9d696548c96cb0ccc8f431", "Title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "Description": "undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-459" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109869", "https://advisory.echohq.com/cve/CVE-2026-109869", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429", "https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436", "https://github.com/nodejs/undici/commit/b5084c7dc239", "https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c", "https://nvd.nist.gov/vuln/detail/CVE-2026-109869", "https://www.cve.org/CVERecord?id=CVE-2026-109869" ], "PublishedDate": "2026-10-15T19:17:21.77Z", "LastModifiedDate": "2026-10-19T20:45:20.34Z" }, { "VulnerabilityID": "CVE-2026-12151", "VendorIDs": [ "GHSA-vxpw-j846-p89q" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "6.27.0, 7.28.0, 8.5.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12151", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:35a1ad4d5df57a83e4e674f9e711e391a628a97c2dae5fbf4209308080945703", "Title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames", "Description": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches: Upgrade to undici \u003e= 6.26.0, \u003e= 7.28.0, or \u003e= 8.5.0. Workarounds:\nNo workaround is available. The fix must be applied through an upgrade.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:35841", "https://access.redhat.com/errata/RHSA-2026:35842", "https://access.redhat.com/errata/RHSA-2026:35891", "https://access.redhat.com/errata/RHSA-2026:35892", "https://access.redhat.com/errata/RHSA-2026:36621", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:38009", "https://access.redhat.com/errata/RHSA-2026:38236", "https://access.redhat.com/errata/RHSA-2026:39246", "https://access.redhat.com/errata/RHSA-2026:39868", "https://access.redhat.com/errata/RHSA-2026:41929", "https://access.redhat.com/errata/RHSA-2026:41947", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/errata/RHSA-2026:48124", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:52399", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66488", "https://access.redhat.com/errata/RHSA-2026:66545", "https://access.redhat.com/security/cve/CVE-2026-12151", "https://advisory.echohq.com/cve/CVE-2026-12151", "https://bugzilla.redhat.com/2476810", "https://bugzilla.redhat.com/2489980", "https://bugzilla.redhat.com/2490000", "https://bugzilla.redhat.com/2490006", "https://bugzilla.redhat.com/2490008", "https://bugzilla.redhat.com/2493325", "https://bugzilla.redhat.com/2493326", "https://bugzilla.redhat.com/2493329", "https://bugzilla.redhat.com/2493331", "https://bugzilla.redhat.com/2493332", "https://bugzilla.redhat.com/2493333", "https://bugzilla.redhat.com/2493335", "https://bugzilla.redhat.com/2493337", "https://bugzilla.redhat.com/show_bug.cgi?id=2476810", "https://bugzilla.redhat.com/show_bug.cgi?id=2489980", "https://bugzilla.redhat.com/show_bug.cgi?id=2490000", "https://bugzilla.redhat.com/show_bug.cgi?id=2490006", "https://bugzilla.redhat.com/show_bug.cgi?id=2490008", "https://bugzilla.redhat.com/show_bug.cgi?id=2493325", "https://bugzilla.redhat.com/show_bug.cgi?id=2493326", "https://bugzilla.redhat.com/show_bug.cgi?id=2493329", "https://bugzilla.redhat.com/show_bug.cgi?id=2493331", "https://bugzilla.redhat.com/show_bug.cgi?id=2493332", "https://bugzilla.redhat.com/show_bug.cgi?id=2493333", "https://bugzilla.redhat.com/show_bug.cgi?id=2493335", "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678", "https://errata.almalinux.org/9/ALSA-2026-35892.html", "https://errata.rockylinux.org/RLSA-2026:35892", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/32dbf0b3dd93daf6d87badf506d52e89f2e20e78", "https://github.com/nodejs/undici/releases/tag/v6.27.0", "https://github.com/nodejs/undici/releases/tag/v7.28.0", "https://github.com/nodejs/undici/releases/tag/v8.5.0", "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q", "https://linux.oracle.com/cve/CVE-2026-12151.html", "https://linux.oracle.com/errata/ELSA-2026-41947.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12151", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json", "https://www.cve.org/CVERecord?id=CVE-2026-12151" ], "PublishedDate": "2026-06-17T17:16:42.37Z", "LastModifiedDate": "2026-09-11T13:17:05.943Z" }, { "VulnerabilityID": "CVE-2026-13697", "VendorIDs": [ "GHSA-4cwx-7wf7-3272" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "7.29.0, 8.9.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13697", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:421687503093382341e83d642086aa287d9aeba0ad145a99ac66c6e7fc95f729", "Title": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives", "Description": "undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200", "CWE-248", "CWE-525" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-13697", "https://advisory.echohq.com/cve/CVE-2026-13697", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451", "https://github.com/nodejs/undici/releases/tag/v7.29.0", "https://github.com/nodejs/undici/releases/tag/v8.9.0", "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272", "https://nvd.nist.gov/vuln/detail/CVE-2026-13697", "https://www.cve.org/CVERecord?id=CVE-2026-13697" ], "PublishedDate": "2026-07-29T17:16:50.503Z", "LastModifiedDate": "2026-08-04T14:17:59.003Z" }, { "VulnerabilityID": "CVE-2026-19534", "VendorIDs": [ "GHSA-rfgv-xxqx-mfg5" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "6.28.1, 7.29.1, 8.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-19534", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:3d2292d7f2f35801178a42e4b713c8e398e9f8befe6efa75840ec8abce8bfb12", "Title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol", "Description": "undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-252" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76750", "https://access.redhat.com/security/cve/CVE-2026-19534", "https://advisory.echohq.com/cve/CVE-2026-19534", "https://bugzilla.redhat.com/2481394", "https://bugzilla.redhat.com/2528759", "https://bugzilla.redhat.com/show_bug.cgi?id=2481394", "https://bugzilla.redhat.com/show_bug.cgi?id=2528759", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9496", "https://errata.almalinux.org/9/ALSA-2026-76750.html", "https://errata.rockylinux.org/RLSA-2026:76750", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5", "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728", "https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad", "https://github.com/nodejs/undici/releases/tag/v6.28.1", "https://github.com/nodejs/undici/releases/tag/v7.29.1", "https://github.com/nodejs/undici/releases/tag/v8.10.2", "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5", "https://linux.oracle.com/cve/CVE-2026-19534.html", "https://linux.oracle.com/errata/ELSA-2026-76750.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-19534", "https://www.cve.org/CVERecord?id=CVE-2026-19534" ], "PublishedDate": "2026-09-04T18:17:51.647Z", "LastModifiedDate": "2026-09-16T20:41:08.75Z" }, { "VulnerabilityID": "CVE-2026-6734", "VendorIDs": [ "GHSA-hm92-r4w5-c3mj" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "7.28.0, 8.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6734", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:bbfa5ba6b8fc322277245f76556926d248a779dbeb09a17198a16c48f185310f", "Title": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing", "Description": "Impact:\nWhen using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.\n\nThis causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.\n\nImpacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.\n\nThis was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.\n\nPatches:\nUpgrade to undici v7.26.0 or v8.2.0.\n\nWorkarounds:\nUse a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-940" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22380", "https://access.redhat.com/errata/RHSA-2026:22934", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:35841", "https://access.redhat.com/errata/RHSA-2026:35891", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:38236", "https://access.redhat.com/errata/RHSA-2026:39868", "https://access.redhat.com/errata/RHSA-2026:41929", "https://access.redhat.com/errata/RHSA-2026:48124", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:7378", "https://access.redhat.com/security/cve/CVE-2026-6734", "https://advisory.echohq.com/cve/CVE-2026-6734", "https://bugzilla.redhat.com/2476810", "https://bugzilla.redhat.com/2489980", "https://bugzilla.redhat.com/2490000", "https://bugzilla.redhat.com/2490006", "https://bugzilla.redhat.com/2490008", "https://bugzilla.redhat.com/2490018", "https://bugzilla.redhat.com/2490024", "https://bugzilla.redhat.com/2493325", "https://bugzilla.redhat.com/2493326", "https://bugzilla.redhat.com/2493329", "https://bugzilla.redhat.com/2493331", "https://bugzilla.redhat.com/2493332", "https://bugzilla.redhat.com/2493333", "https://bugzilla.redhat.com/2493335", "https://bugzilla.redhat.com/2493337", "https://bugzilla.redhat.com/show_bug.cgi?id=2476810", "https://bugzilla.redhat.com/show_bug.cgi?id=2489980", "https://bugzilla.redhat.com/show_bug.cgi?id=2490000", "https://bugzilla.redhat.com/show_bug.cgi?id=2490006", "https://bugzilla.redhat.com/show_bug.cgi?id=2490008", "https://bugzilla.redhat.com/show_bug.cgi?id=2490018", "https://bugzilla.redhat.com/show_bug.cgi?id=2490024", "https://bugzilla.redhat.com/show_bug.cgi?id=2493325", "https://bugzilla.redhat.com/show_bug.cgi?id=2493326", "https://bugzilla.redhat.com/show_bug.cgi?id=2493329", "https://bugzilla.redhat.com/show_bug.cgi?id=2493331", "https://bugzilla.redhat.com/show_bug.cgi?id=2493332", "https://bugzilla.redhat.com/show_bug.cgi?id=2493333", "https://bugzilla.redhat.com/show_bug.cgi?id=2493335", "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6734", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9697", "https://errata.almalinux.org/9/ALSA-2026-35891.html", "https://errata.rockylinux.org/RLSA-2026:35891", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/pull/5041", "https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj", "https://linux.oracle.com/cve/CVE-2026-6734.html", "https://linux.oracle.com/errata/ELSA-2026-39868.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-6734", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6734.json", "https://www.cve.org/CVERecord?id=CVE-2026-6734" ], "PublishedDate": "2026-06-17T18:18:05.617Z", "LastModifiedDate": "2026-09-10T13:20:30.103Z" }, { "VulnerabilityID": "CVE-2026-84961", "VendorIDs": [ "GHSA-w293-vg96-wgc3" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "7.29.1, 8.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84961", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:0a26e8e0dda9193538ae77ea482a2367c9a1926c2c1bd6d728bee30a4da65b92", "Title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options", "Description": "undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:73838", "https://access.redhat.com/security/cve/CVE-2026-84961", "https://advisory.echohq.com/cve/CVE-2026-84961", "https://bugzilla.redhat.com/2528717", "https://bugzilla.redhat.com/2528735", "https://bugzilla.redhat.com/2528759", "https://bugzilla.redhat.com/show_bug.cgi?id=2528717", "https://bugzilla.redhat.com/show_bug.cgi?id=2528735", "https://bugzilla.redhat.com/show_bug.cgi?id=2528759", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85152", "https://errata.almalinux.org/9/ALSA-2026-73838.html", "https://errata.rockylinux.org/RLSA-2026:73838", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390", "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96", "https://github.com/nodejs/undici/releases/tag/v7.29.1", "https://github.com/nodejs/undici/releases/tag/v8.10.2", "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3", "https://linux.oracle.com/cve/CVE-2026-84961.html", "https://linux.oracle.com/errata/ELSA-2026-74085.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84961", "https://www.cve.org/CVERecord?id=CVE-2026-84961" ], "PublishedDate": "2026-09-04T17:17:02.227Z", "LastModifiedDate": "2026-09-15T14:29:35.253Z" }, { "VulnerabilityID": "CVE-2026-87018", "VendorIDs": [ "GHSA-qrxm-fqhp-jwvm" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87018", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:544db42c081f29d093d1a2223765b4e8e4fab3ef25d9c4fd0742f5c0d77d82ed", "Title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "Description": "undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-617" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87018", "https://advisory.echohq.com/cve/CVE-2026-87018", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309", "https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28", "https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm", "https://nvd.nist.gov/vuln/detail/CVE-2026-87018", "https://www.cve.org/CVERecord?id=CVE-2026-87018" ], "PublishedDate": "2026-10-15T19:17:46.6Z", "LastModifiedDate": "2026-10-19T20:41:16.643Z" }, { "VulnerabilityID": "CVE-2026-9697", "VendorIDs": [ "GHSA-vmh5-mc38-953g" ], "PkgID": "undici@7.25.0", "PkgName": "undici", "PkgPath": "app/node_modules/.bun/undici@7.25.0/node_modules/undici/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@7.25.0", "UID": "eb554dcac5ae4c" }, "InstalledVersion": "7.25.0", "FixedVersion": "7.28.0, 8.5.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9697", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:5223955de8fce2dd180a8999d564850a2738df1cf0a4a92b990be9b756b1b30c", "Title": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy", "Description": "Impact:\nundici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.\n\nApplications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.\n\nAffected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.\n\nPatches:\nUpgrade to undici v7.28.0 or v8.5.0.\n\nWorkarounds:\nNo workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22380", "https://access.redhat.com/errata/RHSA-2026:22934", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:35841", "https://access.redhat.com/errata/RHSA-2026:35891", "https://access.redhat.com/errata/RHSA-2026:36621", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:38236", "https://access.redhat.com/errata/RHSA-2026:39868", "https://access.redhat.com/errata/RHSA-2026:41929", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/errata/RHSA-2026:48124", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:7378", "https://access.redhat.com/security/cve/CVE-2026-9697", "https://advisory.echohq.com/cve/CVE-2026-9697", "https://bugzilla.redhat.com/2476810", "https://bugzilla.redhat.com/2489980", "https://bugzilla.redhat.com/2490000", "https://bugzilla.redhat.com/2490006", "https://bugzilla.redhat.com/2490008", "https://bugzilla.redhat.com/2490018", "https://bugzilla.redhat.com/2490024", "https://bugzilla.redhat.com/2493325", "https://bugzilla.redhat.com/2493326", "https://bugzilla.redhat.com/2493329", "https://bugzilla.redhat.com/2493331", "https://bugzilla.redhat.com/2493332", "https://bugzilla.redhat.com/2493333", "https://bugzilla.redhat.com/2493335", "https://bugzilla.redhat.com/2493337", "https://bugzilla.redhat.com/show_bug.cgi?id=2476810", "https://bugzilla.redhat.com/show_bug.cgi?id=2489980", "https://bugzilla.redhat.com/show_bug.cgi?id=2490000", "https://bugzilla.redhat.com/show_bug.cgi?id=2490006", "https://bugzilla.redhat.com/show_bug.cgi?id=2490008", "https://bugzilla.redhat.com/show_bug.cgi?id=2490018", "https://bugzilla.redhat.com/show_bug.cgi?id=2490024", "https://bugzilla.redhat.com/show_bug.cgi?id=2493325", "https://bugzilla.redhat.com/show_bug.cgi?id=2493326", "https://bugzilla.redhat.com/show_bug.cgi?id=2493329", "https://bugzilla.redhat.com/show_bug.cgi?id=2493331", "https://bugzilla.redhat.com/show_bug.cgi?id=2493332", "https://bugzilla.redhat.com/show_bug.cgi?id=2493333", "https://bugzilla.redhat.com/show_bug.cgi?id=2493335", "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6734", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9697", "https://errata.almalinux.org/9/ALSA-2026-35891.html", "https://errata.rockylinux.org/RLSA-2026:35891", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g", "https://linux.oracle.com/cve/CVE-2026-9697.html", "https://linux.oracle.com/errata/ELSA-2026-39868.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9697", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9697.json", "https://www.cve.org/CVERecord?id=CVE-2026-9697" ], "PublishedDate": "2026-06-17T18:18:06.473Z", "LastModifiedDate": "2026-09-10T13:20:34.513Z" }, { "VulnerabilityID": "CVE-2026-109383", "VendorIDs": [ "GHSA-2m5v-pch6-74hx" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109383", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ed28d73d95b28d298fa9d7babdec0fea21f8cbda19ff15e5f8cc6786e07eca71", "Title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "Description": "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109383", "https://advisory.echohq.com/cve/CVE-2026-109383", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4", "https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f", "https://github.com/nodejs/undici/commit/f75eac00ac17", "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx", "https://nvd.nist.gov/vuln/detail/CVE-2026-109383", "https://www.cve.org/CVERecord?id=CVE-2026-109383" ], "PublishedDate": "2026-10-15T19:17:20.853Z", "LastModifiedDate": "2026-10-19T20:45:52.41Z" }, { "VulnerabilityID": "CVE-2026-109829", "VendorIDs": [ "GHSA-4w7w-5xrc-9h26" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109829", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:5513bfca1c5c88f4e0e83fc7cc940a221a48ab9e92281b8a4b23d8e2b6f87cb6", "Title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "Description": "undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-524" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109829", "https://advisory.echohq.com/cve/CVE-2026-109829", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/26c2bfb3def0", "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8", "https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26", "https://nvd.nist.gov/vuln/detail/CVE-2026-109829", "https://www.cve.org/CVERecord?id=CVE-2026-109829" ], "PublishedDate": "2026-10-15T19:17:21.513Z", "LastModifiedDate": "2026-10-19T20:45:43.39Z" }, { "VulnerabilityID": "CVE-2026-109869", "VendorIDs": [ "GHSA-xjj6-f33q-929c" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109869", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:d1d7fb0d4fa9b54b97b081a053f4671687ee0c333934525853c6003aa1ab7665", "Title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "Description": "undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-459" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-109869", "https://advisory.echohq.com/cve/CVE-2026-109869", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429", "https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436", "https://github.com/nodejs/undici/commit/b5084c7dc239", "https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c", "https://nvd.nist.gov/vuln/detail/CVE-2026-109869", "https://www.cve.org/CVERecord?id=CVE-2026-109869" ], "PublishedDate": "2026-10-15T19:17:21.77Z", "LastModifiedDate": "2026-10-19T20:45:20.34Z" }, { "VulnerabilityID": "CVE-2026-19534", "VendorIDs": [ "GHSA-rfgv-xxqx-mfg5" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "6.28.1, 7.29.1, 8.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-19534", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:8a81635c5ad8349093f2b390c47a1cd4cd4a04e69c61400474af6d98008d1206", "Title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol", "Description": "undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-252" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76750", "https://access.redhat.com/security/cve/CVE-2026-19534", "https://advisory.echohq.com/cve/CVE-2026-19534", "https://bugzilla.redhat.com/2481394", "https://bugzilla.redhat.com/2528759", "https://bugzilla.redhat.com/show_bug.cgi?id=2481394", "https://bugzilla.redhat.com/show_bug.cgi?id=2528759", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9496", "https://errata.almalinux.org/9/ALSA-2026-76750.html", "https://errata.rockylinux.org/RLSA-2026:76750", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5", "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728", "https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad", "https://github.com/nodejs/undici/releases/tag/v6.28.1", "https://github.com/nodejs/undici/releases/tag/v7.29.1", "https://github.com/nodejs/undici/releases/tag/v8.10.2", "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5", "https://linux.oracle.com/cve/CVE-2026-19534.html", "https://linux.oracle.com/errata/ELSA-2026-76750.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-19534", "https://www.cve.org/CVERecord?id=CVE-2026-19534" ], "PublishedDate": "2026-09-04T18:17:51.647Z", "LastModifiedDate": "2026-09-16T20:41:08.75Z" }, { "VulnerabilityID": "CVE-2026-84961", "VendorIDs": [ "GHSA-w293-vg96-wgc3" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "7.29.1, 8.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84961", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:cd11a5c8f8199a03d2ab460c8d816903f08fcf704ef2d28d470021f4dd2c159f", "Title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options", "Description": "undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:73838", "https://access.redhat.com/security/cve/CVE-2026-84961", "https://advisory.echohq.com/cve/CVE-2026-84961", "https://bugzilla.redhat.com/2528717", "https://bugzilla.redhat.com/2528735", "https://bugzilla.redhat.com/2528759", "https://bugzilla.redhat.com/show_bug.cgi?id=2528717", "https://bugzilla.redhat.com/show_bug.cgi?id=2528735", "https://bugzilla.redhat.com/show_bug.cgi?id=2528759", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85152", "https://errata.almalinux.org/9/ALSA-2026-73838.html", "https://errata.rockylinux.org/RLSA-2026:73838", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390", "https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96", "https://github.com/nodejs/undici/releases/tag/v7.29.1", "https://github.com/nodejs/undici/releases/tag/v8.10.2", "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3", "https://linux.oracle.com/cve/CVE-2026-84961.html", "https://linux.oracle.com/errata/ELSA-2026-74085.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84961", "https://www.cve.org/CVERecord?id=CVE-2026-84961" ], "PublishedDate": "2026-09-04T17:17:02.227Z", "LastModifiedDate": "2026-09-15T14:29:35.253Z" }, { "VulnerabilityID": "CVE-2026-85152", "VendorIDs": [ "GHSA-vp8m-p9jh-q5pm" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "8.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85152", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:ec92c9ffadf2838c55b1e28ff8e88d6a81090baab7fdde3e60ad135d33f0e972", "Title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation", "Description": "undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.", "Severity": "HIGH", "CweIDs": [ "CWE-346" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:73838", "https://access.redhat.com/security/cve/CVE-2026-85152", "https://advisory.echohq.com/cve/CVE-2026-85152", "https://bugzilla.redhat.com/2528717", "https://bugzilla.redhat.com/2528735", "https://bugzilla.redhat.com/2528759", "https://bugzilla.redhat.com/show_bug.cgi?id=2528717", "https://bugzilla.redhat.com/show_bug.cgi?id=2528735", "https://bugzilla.redhat.com/show_bug.cgi?id=2528759", "https://cna.openjsf.org/security-advisories.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85152", "https://errata.almalinux.org/9/ALSA-2026-73838.html", "https://errata.rockylinux.org/RLSA-2026:73838", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/caf6194d3dae989b731ed87ab85f182befe5eb80", "https://github.com/nodejs/undici/releases/tag/v8.10.2", "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm", "https://linux.oracle.com/cve/CVE-2026-85152.html", "https://linux.oracle.com/errata/ELSA-2026-74085.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-85152", "https://www.cve.org/CVERecord?id=CVE-2026-85152" ], "PublishedDate": "2026-09-04T17:17:02.717Z", "LastModifiedDate": "2026-09-16T20:41:35.683Z" }, { "VulnerabilityID": "CVE-2026-87018", "VendorIDs": [ "GHSA-qrxm-fqhp-jwvm" ], "PkgID": "undici@8.10.0", "PkgName": "undici", "PkgPath": "root/.bun/install/cache/undici@8.10.0@@@1/package.json", "PkgIdentifier": { "PURL": "pkg:npm/undici@8.10.0", "UID": "66a53f5d0b414dc6" }, "InstalledVersion": "8.10.0", "FixedVersion": "6.29.1, 7.30.1, 8.12.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87018", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:e7e4242486467b04ab9ad91f9e09cbfd94b39868434854f1ae7232be93126941", "Title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "Description": "undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-617" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87018", "https://advisory.echohq.com/cve/CVE-2026-87018", "https://cna.openjsf.org/security-advisories.html", "https://github.com/nodejs/undici", "https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309", "https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28", "https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8", "https://github.com/nodejs/undici/releases/tag/v6.29.1", "https://github.com/nodejs/undici/releases/tag/v7.30.1", "https://github.com/nodejs/undici/releases/tag/v8.12.2", "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm", "https://nvd.nist.gov/vuln/detail/CVE-2026-87018", "https://www.cve.org/CVERecord?id=CVE-2026-87018" ], "PublishedDate": "2026-10-15T19:17:46.6Z", "LastModifiedDate": "2026-10-19T20:41:16.643Z" }, { "VulnerabilityID": "CVE-2026-112942", "VendorIDs": [ "GHSA-587h-7wmj-h5pm" ], "PkgID": "vite@6.4.1", "PkgName": "vite", "PkgPath": "app/node_modules/.bun/vite@6.4.1+d6e2dda1aa32e95f/node_modules/vite/package.json", "PkgIdentifier": { "PURL": "pkg:npm/vite@6.4.1", "UID": "dd3a8fbea00bcdf3" }, "InstalledVersion": "6.4.1", "FixedVersion": "8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112942", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:d2b61fd2633beda7463938955cd25595f9a79e305d20cbeef938167dd67d5be7", "Title": "launch-editor: launch-editor: Command injection via improper file path validation", "Description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.", "Severity": "HIGH", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112942", "https://advisory.echohq.com/cve/CVE-2026-112942", "https://github.com/vitejs/launch-editor", "https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679", "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm", "https://nvd.nist.gov/vuln/detail/CVE-2026-112942", "https://www.cve.org/CVERecord?id=CVE-2026-112942" ], "PublishedDate": "2026-10-20T15:17:17.23Z", "LastModifiedDate": "2026-10-21T16:17:15.207Z" }, { "VulnerabilityID": "CVE-2026-39363", "VendorIDs": [ "GHSA-p9ff-h696-f583" ], "PkgID": "vite@6.4.1", "PkgName": "vite", "PkgPath": "app/node_modules/.bun/vite@6.4.1+d6e2dda1aa32e95f/node_modules/vite/package.json", "PkgIdentifier": { "PURL": "pkg:npm/vite@6.4.1", "UID": "dd3a8fbea00bcdf3" }, "InstalledVersion": "6.4.1", "FixedVersion": "8.0.5, 7.3.2, 6.4.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39363", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:77d0e0c8ee103d4f689171036b87adc2065f54deb3ddbb87949291138f3b2b16", "Title": "Vite: Vite: Information disclosure via WebSocket connection bypasses access control", "Description": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default \"...\"). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.", "Severity": "HIGH", "CweIDs": [ "CWE-200", "CWE-306", "CWE-1220" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/errata/RHSA-2026:59153", "https://access.redhat.com/security/cve/CVE-2026-39363", "https://bugzilla.redhat.com/show_bug.cgi?id=2456179", "https://github.com/vitejs/vite", "https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0", "https://github.com/vitejs/vite/pull/22159", "https://github.com/vitejs/vite/releases/tag/v6.4.2", "https://github.com/vitejs/vite/releases/tag/v7.3.2", "https://github.com/vitejs/vite/releases/tag/v8.0.5", "https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583", "https://nvd.nist.gov/vuln/detail/CVE-2026-39363", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39363.json", "https://www.cve.org/CVERecord?id=CVE-2026-39363" ], "PublishedDate": "2026-04-07T20:16:30Z", "LastModifiedDate": "2026-08-25T13:18:45.007Z" }, { "VulnerabilityID": "CVE-2026-112942", "VendorIDs": [ "GHSA-587h-7wmj-h5pm" ], "PkgID": "vite@8.0.1", "PkgName": "vite", "PkgPath": "app/node_modules/.bun/vite@8.0.1+73ecf28eeef21114/node_modules/vite/package.json", "PkgIdentifier": { "PURL": "pkg:npm/vite@8.0.1", "UID": "40fa74c680d5434a" }, "InstalledVersion": "8.0.1", "FixedVersion": "8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112942", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:b918d88bb87626eda01f0279087d73f09eae3d19e1962cdd7b839adbb82a0ac8", "Title": "launch-editor: launch-editor: Command injection via improper file path validation", "Description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.", "Severity": "HIGH", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112942", "https://advisory.echohq.com/cve/CVE-2026-112942", "https://github.com/vitejs/launch-editor", "https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679", "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm", "https://nvd.nist.gov/vuln/detail/CVE-2026-112942", "https://www.cve.org/CVERecord?id=CVE-2026-112942" ], "PublishedDate": "2026-10-20T15:17:17.23Z", "LastModifiedDate": "2026-10-21T16:17:15.207Z" }, { "VulnerabilityID": "CVE-2026-39363", "VendorIDs": [ "GHSA-p9ff-h696-f583" ], "PkgID": "vite@8.0.1", "PkgName": "vite", "PkgPath": "app/node_modules/.bun/vite@8.0.1+73ecf28eeef21114/node_modules/vite/package.json", "PkgIdentifier": { "PURL": "pkg:npm/vite@8.0.1", "UID": "40fa74c680d5434a" }, "InstalledVersion": "8.0.1", "FixedVersion": "8.0.5, 7.3.2, 6.4.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39363", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:462cab18273d1b11409ebb2b966266f3510ce9a9b7e53e977e675d1ee81fdf82", "Title": "Vite: Vite: Information disclosure via WebSocket connection bypasses access control", "Description": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default \"...\"). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.", "Severity": "HIGH", "CweIDs": [ "CWE-200", "CWE-306", "CWE-1220" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/errata/RHSA-2026:59153", "https://access.redhat.com/security/cve/CVE-2026-39363", "https://bugzilla.redhat.com/show_bug.cgi?id=2456179", "https://github.com/vitejs/vite", "https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0", "https://github.com/vitejs/vite/pull/22159", "https://github.com/vitejs/vite/releases/tag/v6.4.2", "https://github.com/vitejs/vite/releases/tag/v7.3.2", "https://github.com/vitejs/vite/releases/tag/v8.0.5", "https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583", "https://nvd.nist.gov/vuln/detail/CVE-2026-39363", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39363.json", "https://www.cve.org/CVERecord?id=CVE-2026-39363" ], "PublishedDate": "2026-04-07T20:16:30Z", "LastModifiedDate": "2026-08-25T13:18:45.007Z" }, { "VulnerabilityID": "CVE-2026-39364", "VendorIDs": [ "GHSA-v2wj-q39q-566r" ], "PkgID": "vite@8.0.1", "PkgName": "vite", "PkgPath": "app/node_modules/.bun/vite@8.0.1+73ecf28eeef21114/node_modules/vite/package.json", "PkgIdentifier": { "PURL": "pkg:npm/vite@8.0.1", "UID": "40fa74c680d5434a" }, "InstalledVersion": "8.0.1", "FixedVersion": "8.0.5, 7.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39364", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory npm", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm" }, "Fingerprint": "sha256:adc27cb296fadf0d77c162e4e14bea90b2937b0940f6544e25c77839b28de41f", "Title": "vite: Vite: Information disclosure via query parameter manipulation on the development server", "Description": "Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import\u0026raw, or ?import\u0026url\u0026inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.", "Severity": "HIGH", "CweIDs": [ "CWE-180", "CWE-284", "CWE-472" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/security/cve/CVE-2026-39364", "https://bugzilla.redhat.com/show_bug.cgi?id=2456181", "https://github.com/vitejs/vite", "https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff", "https://github.com/vitejs/vite/pull/22160", "https://github.com/vitejs/vite/releases/tag/v7.3.2", "https://github.com/vitejs/vite/releases/tag/v8.0.5", "https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r", "https://nvd.nist.gov/vuln/detail/CVE-2026-39364", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json", "https://www.cve.org/CVERecord?id=CVE-2026-39364" ], "PublishedDate": "2026-04-07T20:16:30.17Z", "LastModifiedDate": "2026-08-04T13:18:24.733Z" } ] }, { "Target": "app/node_modules/.bun/@esbuild+linux-x64@0.18.20/node_modules/@esbuild/linux-x64/bin/esbuild", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/evanw/esbuild", "Name": "github.com/evanw/esbuild", "Identifier": { "PURL": "pkg:golang/github.com/evanw/esbuild", "UID": "581f1159ac3eeb0b" }, "Relationship": "root", "DependsOn": [ "golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "stdlib@v1.20.7" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.20.7", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "Version": "v1.20.7", "Relationship": "direct", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "UID": "fad5a5eab30dffcb" }, "Version": "v0.0.0-20220715151400-c0bba94af5f8", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2024-24790", "VendorIDs": [ "GO-2024-2887" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.21.11, 1.22.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-24790", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0140c1a0f2a102b92b3a32d18853db8983c941aeaa4d7b9636415980eab97f67", "Title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "Description": "The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.", "Severity": "CRITICAL", "VendorSeverity": { "alma": 2, "amazon": 3, "bitnami": 4, "bottlerocket": 2, "cbl-mariner": 4, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "http://www.openwall.com/lists/oss-security/2024/06/04/1", "https://access.redhat.com/errata/RHSA-2025:7256", "https://access.redhat.com/security/cve/CVE-2024-24790", "https://bugzilla.redhat.com/2237777", "https://bugzilla.redhat.com/2237778", "https://bugzilla.redhat.com/2279814", "https://bugzilla.redhat.com/2292787", "https://bugzilla.redhat.com/2295310", "https://bugzilla.redhat.com/2315719", "https://bugzilla.redhat.com/show_bug.cgi?id=2237777", "https://bugzilla.redhat.com/show_bug.cgi?id=2237778", "https://bugzilla.redhat.com/show_bug.cgi?id=2279814", "https://bugzilla.redhat.com/show_bug.cgi?id=2292787", "https://bugzilla.redhat.com/show_bug.cgi?id=2295310", "https://bugzilla.redhat.com/show_bug.cgi?id=2315719", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24788", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9355", "https://errata.almalinux.org/9/ALSA-2025-7256.html", "https://errata.rockylinux.org/RLSA-2025:7256", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/2.9.0/BRSA-glvb5gspjgq6.toml", "https://github.com/golang/go/commit/051bdf3fd12a40307606ff9381138039c5f452f0%20%281.21%29", "https://github.com/golang/go/commit/12d5810cdb1f73cf23d7a86462143e9463317fca%20%281.22%29", "https://github.com/golang/go/issues/67680", "https://go.dev/cl/590316", "https://go.dev/issue/67680", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ", "https://linux.oracle.com/cve/CVE-2024-24790.html", "https://linux.oracle.com/errata/ELSA-2025-7256.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-24790", "https://pkg.go.dev/vuln/GO-2024-2887", "https://security.netapp.com/advisory/ntap-20240905-0002/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cve.org/CVERecord?id=CVE-2024-24790" ], "PublishedDate": "2024-06-05T16:15:10.56Z", "LastModifiedDate": "2026-06-17T07:14:52.097Z" }, { "VulnerabilityID": "CVE-2025-68121", "VendorIDs": [ "GO-2026-4337" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68121", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a48897849a6b3002a1495c454732617d05edb5bbe591871ec2ab41544fdf77c7", "Title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "Description": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/security/cve/CVE-2025-68121", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://github.com/golang/go/issues/77113", "https://go.dev/cl/737700", "https://go.dev/issue/77217", "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-68121.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-68121", "https://pkg.go.dev/vuln/GO-2026-4337", "https://www.cve.org/CVERecord?id=CVE-2025-68121" ], "PublishedDate": "2026-02-05T18:16:10.857Z", "LastModifiedDate": "2026-06-17T09:58:33.833Z" }, { "VulnerabilityID": "CVE-2023-39325", "VendorIDs": [ "GHSA-4374-p667-p6c8", "GO-2023-2102" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.20.10, 1.21.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39325", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1eb3e9c5af688d4e2bdb00b1fc1dd1659bd6b2b91c8f30a71424e1270928295c", "Title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)", "Description": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "bottlerocket": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325", "https://access.redhat.com/errata/RHSA-2023:6077", "https://access.redhat.com/security/cve/CVE-2023-39325", "https://access.redhat.com/security/cve/CVE-2023-44487", "https://bugzilla.redhat.com/2242803", "https://bugzilla.redhat.com/2243296", "https://bugzilla.redhat.com/show_bug.cgi?id=2242803", "https://bugzilla.redhat.com/show_bug.cgi?id=2243296", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487", "https://errata.almalinux.org/9/ALSA-2023-6077.html", "https://errata.rockylinux.org/RLSA-2023:6077", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-48vh-q3rp-4grw", "https://github.com/golang/go/commit/24ae2d927285c697440fdde3ad7f26028354bcf3%20%5Bgolang-%201.21%5D", "https://github.com/golang/go/commit/e175f27f58aa7b9cd4d79607ae65d2cd5baaee68%20%5Bgolang-1.20%5D", "https://github.com/golang/go/issues/63417", "https://go.dev/cl/534215", "https://go.dev/cl/534235", "https://go.dev/issue/63417", "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ", "https://linux.oracle.com/cve/CVE-2023-39325.html", "https://linux.oracle.com/errata/ELSA-2023-5867.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/", "https://nvd.nist.gov/vuln/detail/CVE-2023-39325", "https://pkg.go.dev/vuln/GO-2023-2102", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20231110-0008/", "https://ubuntu.com/security/notices/USN-6574-1", "https://ubuntu.com/security/notices/USN-7061-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "https://www.cve.org/CVERecord?id=CVE-2023-39325" ], "PublishedDate": "2023-10-11T22:15:09.88Z", "LastModifiedDate": "2026-06-17T06:12:02.173Z" }, { "VulnerabilityID": "CVE-2023-45283", "VendorIDs": [ "GO-2023-2185" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.20.11, 1.21.4, 1.20.12, 1.21.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d354eeb3c3cde35ba10b53969d5db55eec50f57feab784f71767ab2df0f30512", "Title": "The filepath package does not recognize paths with a \\??\\ prefix as sp ...", "Description": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "photon": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/12/05/2", "https://go.dev/cl/540277", "https://go.dev/cl/541175", "https://go.dev/issue/63713", "https://go.dev/issue/64028", "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ", "https://nvd.nist.gov/vuln/detail/CVE-2023-45283", "https://pkg.go.dev/vuln/GO-2023-2185", "https://security.netapp.com/advisory/ntap-20231214-0008/" ], "PublishedDate": "2023-11-09T17:15:08.757Z", "LastModifiedDate": "2026-06-17T06:28:34.863Z" }, { "VulnerabilityID": "CVE-2023-45288", "VendorIDs": [ "GHSA-4v7x-pqxf-cx7m", "GO-2024-2687" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.21.9, 1.22.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45288", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:923359f5307e4e2105d6e93097619726a6e77c6e764c99832d63864e64924fc2", "Title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "Description": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "bottlerocket": 2, "cbl-mariner": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "http://www.openwall.com/lists/oss-security/2024/04/03/16", "http://www.openwall.com/lists/oss-security/2024/04/05/4", "https://access.redhat.com/errata/RHSA-2024:2724", "https://access.redhat.com/security/cve/CVE-2023-45288", "https://bugzilla.redhat.com/2268017", "https://bugzilla.redhat.com/2268018", "https://bugzilla.redhat.com/2268019", "https://bugzilla.redhat.com/2268273", "https://bugzilla.redhat.com/show_bug.cgi?id=2268017", "https://bugzilla.redhat.com/show_bug.cgi?id=2268018", "https://bugzilla.redhat.com/show_bug.cgi?id=2268019", "https://bugzilla.redhat.com/show_bug.cgi?id=2268273", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783", "https://errata.almalinux.org/9/ALSA-2024-2724.html", "https://errata.rockylinux.org/RLSA-2024:2724", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c9wf-j9h6-m2r9", "https://go.dev/cl/576155", "https://go.dev/issue/65051", "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M", "https://kb.cert.org/vuls/id/421644", "https://linux.oracle.com/cve/CVE-2023-45288.html", "https://linux.oracle.com/errata/ELSA-2024-3346.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/", "https://nowotarski.info/http2-continuation-flood/", "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "https://pkg.go.dev/vuln/GO-2024-2687", "https://security.netapp.com/advisory/ntap-20240419-0009/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-45288", "https://www.kb.cert.org/vuls/id/421644" ], "PublishedDate": "2024-04-04T21:15:16.113Z", "LastModifiedDate": "2026-06-17T06:28:35.58Z" }, { "VulnerabilityID": "CVE-2024-34156", "VendorIDs": [ "GO-2024-3106" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.22.7, 1.23.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-34156", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1f7c98b0d3530d1492db3b58cc47167b7ddd9b89c931f6f43c550839ea9c188a", "Title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion", "Description": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:3773", "https://access.redhat.com/security/cve/CVE-2024-34156", "https://bugzilla.redhat.com/2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2341750", "https://bugzilla.redhat.com/show_bug.cgi?id=2341751", "https://bugzilla.redhat.com/show_bug.cgi?id=2344219", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866", "https://errata.almalinux.org/9/ALSA-2025-3773.html", "https://errata.rockylinux.org/RLSA-2025:3773", "https://github.com/golang/go/commit/2092294f2b097c5828f4eace6c98a322c1510b01%20%28go1.22.7%29", "https://github.com/golang/go/commit/fa8ff1a46deb6c816304441ec6740ec112e19012%20%28go1.23.1%29", "https://go.dev/cl/611239", "https://go.dev/issue/69139", "https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc", "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk", "https://linux.oracle.com/cve/CVE-2024-34156.html", "https://linux.oracle.com/errata/ELSA-2025-3773.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-34156", "https://pkg.go.dev/vuln/GO-2024-3106", "https://security.netapp.com/advisory/ntap-20240926-0004/", "https://ubuntu.com/security/notices/USN-7081-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2024-34156" ], "PublishedDate": "2024-09-06T21:15:12.02Z", "LastModifiedDate": "2026-06-17T07:33:00.72Z" }, { "VulnerabilityID": "CVE-2025-61726", "VendorIDs": [ "GO-2026-4341" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.24.12, 1.25.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61726", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4a22a2312b882f4dc893f6d2278b0c54c03ec2ac0913fbcd0c29e9aaf196a70c", "Title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "Description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "cbl-mariner": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10096", "https://access.redhat.com/errata/RHSA-2026:10104", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13571", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:15984", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17446", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17595", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:18913", "https://access.redhat.com/errata/RHSA-2026:19013", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2706", "https://access.redhat.com/errata/RHSA-2026:2708", "https://access.redhat.com/errata/RHSA-2026:2709", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:2914", "https://access.redhat.com/errata/RHSA-2026:2920", "https://access.redhat.com/errata/RHSA-2026:3035", "https://access.redhat.com/errata/RHSA-2026:3040", "https://access.redhat.com/errata/RHSA-2026:3089", "https://access.redhat.com/errata/RHSA-2026:3092", "https://access.redhat.com/errata/RHSA-2026:3184", "https://access.redhat.com/errata/RHSA-2026:3186", "https://access.redhat.com/errata/RHSA-2026:3187", "https://access.redhat.com/errata/RHSA-2026:3188", "https://access.redhat.com/errata/RHSA-2026:3192", "https://access.redhat.com/errata/RHSA-2026:3193", "https://access.redhat.com/errata/RHSA-2026:3291", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:3297", "https://access.redhat.com/errata/RHSA-2026:3298", "https://access.redhat.com/errata/RHSA-2026:3336", "https://access.redhat.com/errata/RHSA-2026:3337", "https://access.redhat.com/errata/RHSA-2026:3340", "https://access.redhat.com/errata/RHSA-2026:3341", "https://access.redhat.com/errata/RHSA-2026:3343", "https://access.redhat.com/errata/RHSA-2026:3391", "https://access.redhat.com/errata/RHSA-2026:3416", "https://access.redhat.com/errata/RHSA-2026:3427", "https://access.redhat.com/errata/RHSA-2026:3459", "https://access.redhat.com/errata/RHSA-2026:3468", "https://access.redhat.com/errata/RHSA-2026:3469", "https://access.redhat.com/errata/RHSA-2026:3470", "https://access.redhat.com/errata/RHSA-2026:3471", "https://access.redhat.com/errata/RHSA-2026:3472", "https://access.redhat.com/errata/RHSA-2026:3473", "https://access.redhat.com/errata/RHSA-2026:3489", "https://access.redhat.com/errata/RHSA-2026:3506", "https://access.redhat.com/errata/RHSA-2026:3556", "https://access.redhat.com/errata/RHSA-2026:3559", "https://access.redhat.com/errata/RHSA-2026:3668", "https://access.redhat.com/errata/RHSA-2026:3669", "https://access.redhat.com/errata/RHSA-2026:36873", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:3699", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:3752", "https://access.redhat.com/errata/RHSA-2026:3753", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3812", "https://access.redhat.com/errata/RHSA-2026:3813", "https://access.redhat.com/errata/RHSA-2026:3814", "https://access.redhat.com/errata/RHSA-2026:3815", "https://access.redhat.com/errata/RHSA-2026:3816", "https://access.redhat.com/errata/RHSA-2026:3817", "https://access.redhat.com/errata/RHSA-2026:3818", "https://access.redhat.com/errata/RHSA-2026:3820", "https://access.redhat.com/errata/RHSA-2026:3821", "https://access.redhat.com/errata/RHSA-2026:3822", "https://access.redhat.com/errata/RHSA-2026:3831", "https://access.redhat.com/errata/RHSA-2026:3833", "https://access.redhat.com/errata/RHSA-2026:3835", "https://access.redhat.com/errata/RHSA-2026:3836", "https://access.redhat.com/errata/RHSA-2026:3838", "https://access.redhat.com/errata/RHSA-2026:3839", "https://access.redhat.com/errata/RHSA-2026:3840", "https://access.redhat.com/errata/RHSA-2026:3841", "https://access.redhat.com/errata/RHSA-2026:3843", "https://access.redhat.com/errata/RHSA-2026:3854", "https://access.redhat.com/errata/RHSA-2026:3855", "https://access.redhat.com/errata/RHSA-2026:3856", "https://access.redhat.com/errata/RHSA-2026:3864", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3875", "https://access.redhat.com/errata/RHSA-2026:3879", "https://access.redhat.com/errata/RHSA-2026:3880", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3898", "https://access.redhat.com/errata/RHSA-2026:3905", "https://access.redhat.com/errata/RHSA-2026:3906", "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/errata/RHSA-2026:3929", "https://access.redhat.com/errata/RHSA-2026:3930", "https://access.redhat.com/errata/RHSA-2026:3931", "https://access.redhat.com/errata/RHSA-2026:3932", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:3970", "https://access.redhat.com/errata/RHSA-2026:3971", "https://access.redhat.com/errata/RHSA-2026:3972", "https://access.redhat.com/errata/RHSA-2026:3973", "https://access.redhat.com/errata/RHSA-2026:3974", "https://access.redhat.com/errata/RHSA-2026:3977", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:3985", "https://access.redhat.com/errata/RHSA-2026:40924", "https://access.redhat.com/errata/RHSA-2026:4164", "https://access.redhat.com/errata/RHSA-2026:4166", "https://access.redhat.com/errata/RHSA-2026:4170", "https://access.redhat.com/errata/RHSA-2026:4174", "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:4211", "https://access.redhat.com/errata/RHSA-2026:4220", "https://access.redhat.com/errata/RHSA-2026:4256", "https://access.redhat.com/errata/RHSA-2026:4264", "https://access.redhat.com/errata/RHSA-2026:4267", "https://access.redhat.com/errata/RHSA-2026:4270", "https://access.redhat.com/errata/RHSA-2026:4276", "https://access.redhat.com/errata/RHSA-2026:4434", "https://access.redhat.com/errata/RHSA-2026:4435", "https://access.redhat.com/errata/RHSA-2026:4460", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:4498", "https://access.redhat.com/errata/RHSA-2026:4500", "https://access.redhat.com/errata/RHSA-2026:4510", "https://access.redhat.com/errata/RHSA-2026:4511", "https://access.redhat.com/errata/RHSA-2026:4672", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:4753", "https://access.redhat.com/errata/RHSA-2026:4892", "https://access.redhat.com/errata/RHSA-2026:4901", "https://access.redhat.com/errata/RHSA-2026:4907", "https://access.redhat.com/errata/RHSA-2026:4939", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:4952", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5022", "https://access.redhat.com/errata/RHSA-2026:5030", "https://access.redhat.com/errata/RHSA-2026:5031", "https://access.redhat.com/errata/RHSA-2026:5076", "https://access.redhat.com/errata/RHSA-2026:5077", "https://access.redhat.com/errata/RHSA-2026:5078", "https://access.redhat.com/errata/RHSA-2026:5079", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:5129", "https://access.redhat.com/errata/RHSA-2026:5130", "https://access.redhat.com/errata/RHSA-2026:5131", "https://access.redhat.com/errata/RHSA-2026:5132", "https://access.redhat.com/errata/RHSA-2026:5145", "https://access.redhat.com/errata/RHSA-2026:5146", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5327", "https://access.redhat.com/errata/RHSA-2026:5394", "https://access.redhat.com/errata/RHSA-2026:5439", "https://access.redhat.com/errata/RHSA-2026:5444", "https://access.redhat.com/errata/RHSA-2026:5447", "https://access.redhat.com/errata/RHSA-2026:5452", "https://access.redhat.com/errata/RHSA-2026:5461", "https://access.redhat.com/errata/RHSA-2026:5463", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5533", "https://access.redhat.com/errata/RHSA-2026:5544", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:5636", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:5645", "https://access.redhat.com/errata/RHSA-2026:5649", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:5807", "https://access.redhat.com/errata/RHSA-2026:5851", "https://access.redhat.com/errata/RHSA-2026:5852", "https://access.redhat.com/errata/RHSA-2026:5853", "https://access.redhat.com/errata/RHSA-2026:5948", "https://access.redhat.com/errata/RHSA-2026:5950", "https://access.redhat.com/errata/RHSA-2026:5952", "https://access.redhat.com/errata/RHSA-2026:5968", "https://access.redhat.com/errata/RHSA-2026:6184", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:6226", "https://access.redhat.com/errata/RHSA-2026:6251", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6429", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6554", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:7052", "https://access.redhat.com/errata/RHSA-2026:7249", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7676", "https://access.redhat.com/errata/RHSA-2026:7854", "https://access.redhat.com/errata/RHSA-2026:7942", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:8229", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8431", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2025-61726", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://go.dev/cl/736712", "https://go.dev/issue/77101", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-61726.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61726", "https://pkg.go.dev/vuln/GO-2026-4341", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "https://www.cve.org/CVERecord?id=CVE-2025-61726" ], "PublishedDate": "2026-01-28T20:16:09.713Z", "LastModifiedDate": "2026-09-17T12:17:11.443Z" }, { "VulnerabilityID": "CVE-2025-61729", "VendorIDs": [ "GO-2025-4155" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.24.11, 1.25.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61729", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c93ec5323a0777847b1f179d3b95b45a98d51d5c4ea0daf7ec522f4cb42fbbc5", "Title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "Description": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/security/cve/CVE-2025-61729", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-3928.html", "https://errata.rockylinux.org/RLSA-2026:3928", "https://go.dev/cl/725920", "https://go.dev/issue/76445", "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "https://linux.oracle.com/cve/CVE-2025-61729.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61729", "https://pkg.go.dev/vuln/GO-2025-4155", "https://www.cve.org/CVERecord?id=CVE-2025-61729" ], "PublishedDate": "2025-12-02T19:15:51.447Z", "LastModifiedDate": "2026-10-18T18:10:00.1Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e4c907ce26af97b410746fe8b5f0023a0d5078b8158dd45fdc945a70d426b541", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-25679", "VendorIDs": [ "GO-2026-4601" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.8, 1.26.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25679", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c5f6012d50b6afda47ea3f1ba1383b5ab6aefd04b269f22885eaafc68c14d563", "Title": "net/url: Incorrect parsing of IPv6 host literals in net/url", "Description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "Severity": "HIGH", "CweIDs": [ "CWE-425", "CWE-1286" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10133", "https://access.redhat.com/errata/RHSA-2026:10140", "https://access.redhat.com/errata/RHSA-2026:10141", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10169", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:10701", "https://access.redhat.com/errata/RHSA-2026:10712", "https://access.redhat.com/errata/RHSA-2026:10929", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11375", "https://access.redhat.com/errata/RHSA-2026:11412", "https://access.redhat.com/errata/RHSA-2026:11413", "https://access.redhat.com/errata/RHSA-2026:11686", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:11800", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13642", "https://access.redhat.com/errata/RHSA-2026:13643", "https://access.redhat.com/errata/RHSA-2026:13671", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19022", "https://access.redhat.com/errata/RHSA-2026:19026", "https://access.redhat.com/errata/RHSA-2026:19027", "https://access.redhat.com/errata/RHSA-2026:19031", "https://access.redhat.com/errata/RHSA-2026:19032", "https://access.redhat.com/errata/RHSA-2026:19049", "https://access.redhat.com/errata/RHSA-2026:19055", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19128", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19181", "https://access.redhat.com/errata/RHSA-2026:19184", "https://access.redhat.com/errata/RHSA-2026:19185", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19475", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20581", "https://access.redhat.com/errata/RHSA-2026:20582", "https://access.redhat.com/errata/RHSA-2026:20584", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22733", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24386", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:25043", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26445", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52389", "https://access.redhat.com/errata/RHSA-2026:52390", "https://access.redhat.com/errata/RHSA-2026:52391", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:5941", "https://access.redhat.com/errata/RHSA-2026:5942", "https://access.redhat.com/errata/RHSA-2026:5943", "https://access.redhat.com/errata/RHSA-2026:5944", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:6341", "https://access.redhat.com/errata/RHSA-2026:6344", "https://access.redhat.com/errata/RHSA-2026:6382", "https://access.redhat.com/errata/RHSA-2026:6383", "https://access.redhat.com/errata/RHSA-2026:6388", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:6949", "https://access.redhat.com/errata/RHSA-2026:7005", "https://access.redhat.com/errata/RHSA-2026:7009", "https://access.redhat.com/errata/RHSA-2026:7011", "https://access.redhat.com/errata/RHSA-2026:7259", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7315", "https://access.redhat.com/errata/RHSA-2026:7328", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7665", "https://access.redhat.com/errata/RHSA-2026:7669", "https://access.redhat.com/errata/RHSA-2026:7674", "https://access.redhat.com/errata/RHSA-2026:7833", "https://access.redhat.com/errata/RHSA-2026:7834", "https://access.redhat.com/errata/RHSA-2026:7876", "https://access.redhat.com/errata/RHSA-2026:7877", "https://access.redhat.com/errata/RHSA-2026:7878", "https://access.redhat.com/errata/RHSA-2026:7879", "https://access.redhat.com/errata/RHSA-2026:7883", "https://access.redhat.com/errata/RHSA-2026:7992", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8314", "https://access.redhat.com/errata/RHSA-2026:8322", "https://access.redhat.com/errata/RHSA-2026:8324", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8434", "https://access.redhat.com/errata/RHSA-2026:8456", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:8840", "https://access.redhat.com/errata/RHSA-2026:8841", "https://access.redhat.com/errata/RHSA-2026:8842", "https://access.redhat.com/errata/RHSA-2026:8845", "https://access.redhat.com/errata/RHSA-2026:8847", "https://access.redhat.com/errata/RHSA-2026:8848", "https://access.redhat.com/errata/RHSA-2026:8849", "https://access.redhat.com/errata/RHSA-2026:8851", "https://access.redhat.com/errata/RHSA-2026:8852", "https://access.redhat.com/errata/RHSA-2026:8853", "https://access.redhat.com/errata/RHSA-2026:8855", "https://access.redhat.com/errata/RHSA-2026:8856", "https://access.redhat.com/errata/RHSA-2026:8860", "https://access.redhat.com/errata/RHSA-2026:8877", "https://access.redhat.com/errata/RHSA-2026:8878", "https://access.redhat.com/errata/RHSA-2026:8879", "https://access.redhat.com/errata/RHSA-2026:8881", "https://access.redhat.com/errata/RHSA-2026:8882", "https://access.redhat.com/errata/RHSA-2026:8930", "https://access.redhat.com/errata/RHSA-2026:8931", "https://access.redhat.com/errata/RHSA-2026:8949", "https://access.redhat.com/errata/RHSA-2026:9043", "https://access.redhat.com/errata/RHSA-2026:9044", "https://access.redhat.com/errata/RHSA-2026:9052", "https://access.redhat.com/errata/RHSA-2026:9090", "https://access.redhat.com/errata/RHSA-2026:9093", "https://access.redhat.com/errata/RHSA-2026:9094", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9434", "https://access.redhat.com/errata/RHSA-2026:9435", "https://access.redhat.com/errata/RHSA-2026:9436", "https://access.redhat.com/errata/RHSA-2026:9439", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9461", "https://access.redhat.com/errata/RHSA-2026:9695", "https://access.redhat.com/errata/RHSA-2026:9742", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-25679", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://errata.almalinux.org/9/ALSA-2026-9044.html", "https://errata.rockylinux.org/RLSA-2026:9044", "https://go.dev/cl/752180", "https://go.dev/issue/77578", "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "https://linux.oracle.com/cve/CVE-2026-25679.html", "https://linux.oracle.com/errata/ELSA-2026-9044.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "https://pkg.go.dev/vuln/GO-2026-4601", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json", "https://www.cve.org/CVERecord?id=CVE-2026-25679" ], "PublishedDate": "2026-03-06T22:16:00.72Z", "LastModifiedDate": "2026-09-18T13:17:30.067Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:08280bd7b19a7035d1f56f08bb2ceb093c1bd60ac982eba5d9dc92b56160f729", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e813384b840c154c4d5de13e809c03201358c1bb5fd52a05262718580063352c", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d73732c52148925baf69cf8102d6dabd21af6fd110dcda66b8cbdd07c4ccbf90", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2b72869a299188543d2aad97896c11f8ad7907d3e0fd69a42e77441f335af3af", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:db380d12d44a53f511615582c0d72f03714b3b453eb1fe4d20d427337edff707", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a5027a4d45610863890407234593829c489f74e10e6a71916290cda6ef26bd1e", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:99cbc937054194ebad8fbf4f192b5730ad20d19138971b3d3da18db96821491d", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6c6c5c71990af0712ecb74d513979bc64d8d0561faeaa6357d668fc47e562191", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bf15d9af798de941a05ba068d6746f937aeffae45a35f1834f5968d097a7fb59", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:28ecc8153b15fcfae1cf9972824782c8cb9a702aed3ff7f9e5c0ea443ce0b753", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a075a36a510a47698d6ec8d1017adab4acb0b041f9eb5a132294e8ae728157d6", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f651a9c601f7c6f37d47c6749df31385438ddd883175eeccc663c3618da203e3", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a1d4528aaf452bc0d07e284d153bfb0b9904c1db1d34fe7baf1b3a002f3d01b0", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:35673c85b76d742da58d96b565a1d2ae77a2094809095a51805af0a93fe3ab4a", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2071f8119b1cea32f418530cc359a2a1e18bbfaa6ac8842b60b0eb681f6e78f8", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2c2927dc12d4978ae051016b2def653d3fce2b7d4857dcae8a25aee535f54762", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a7263684e9c0fbf266c6a44c773e7d92f57479ecea16cf277b0c288ad8f393b2", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:091f980dd05f7912ccfab5edf5ff1e5f5a1678d508b6aa470f58ab2710ec0772", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:645d91c0d4a39b53d0163f0b102c373bdb04c31aa5018f6a227aace68f9ef72a", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b180f3bf0d996ba283080ab6c9ea788803c9e21e50d3037a3bbdfafba7a9a4e0", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.20.7", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.20.7", "UID": "b04beac993a86e33" }, "InstalledVersion": "v1.20.7", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:03fd66a0527f041f9367c23d2c1fe28a6e4f38ba5761f2d5cbda5e6f90f9e559", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] }, { "Target": "app/node_modules/.bun/@esbuild+linux-x64@0.25.12/node_modules/@esbuild/linux-x64/bin/esbuild", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/evanw/esbuild", "Name": "github.com/evanw/esbuild", "Identifier": { "PURL": "pkg:golang/github.com/evanw/esbuild", "UID": "7da50155b04f8c04" }, "Relationship": "root", "DependsOn": [ "golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "stdlib@v1.23.12" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.23.12", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "Version": "v1.23.12", "Relationship": "direct", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.0.0-20220715151400-c0bba94af5f8", "UID": "8ec471ec22d83c84" }, "Version": "v0.0.0-20220715151400-c0bba94af5f8", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2025-68121", "VendorIDs": [ "GO-2026-4337" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68121", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2c6385acdedf7535ed5e4800cfd490736dba9651c2f08348ad81fecab30443cb", "Title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "Description": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/security/cve/CVE-2025-68121", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://github.com/golang/go/issues/77113", "https://go.dev/cl/737700", "https://go.dev/issue/77217", "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-68121.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-68121", "https://pkg.go.dev/vuln/GO-2026-4337", "https://www.cve.org/CVERecord?id=CVE-2025-68121" ], "PublishedDate": "2026-02-05T18:16:10.857Z", "LastModifiedDate": "2026-06-17T09:58:33.833Z" }, { "VulnerabilityID": "CVE-2025-61726", "VendorIDs": [ "GO-2026-4341" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.24.12, 1.25.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61726", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fb0819693112852a872aba76e62b413a0b0487cba759942e300fb4e341d42550", "Title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "Description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "cbl-mariner": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10096", "https://access.redhat.com/errata/RHSA-2026:10104", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13571", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:15984", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17446", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17595", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:18913", "https://access.redhat.com/errata/RHSA-2026:19013", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2706", "https://access.redhat.com/errata/RHSA-2026:2708", "https://access.redhat.com/errata/RHSA-2026:2709", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:2914", "https://access.redhat.com/errata/RHSA-2026:2920", "https://access.redhat.com/errata/RHSA-2026:3035", "https://access.redhat.com/errata/RHSA-2026:3040", "https://access.redhat.com/errata/RHSA-2026:3089", "https://access.redhat.com/errata/RHSA-2026:3092", "https://access.redhat.com/errata/RHSA-2026:3184", "https://access.redhat.com/errata/RHSA-2026:3186", "https://access.redhat.com/errata/RHSA-2026:3187", "https://access.redhat.com/errata/RHSA-2026:3188", "https://access.redhat.com/errata/RHSA-2026:3192", "https://access.redhat.com/errata/RHSA-2026:3193", "https://access.redhat.com/errata/RHSA-2026:3291", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:3297", "https://access.redhat.com/errata/RHSA-2026:3298", "https://access.redhat.com/errata/RHSA-2026:3336", "https://access.redhat.com/errata/RHSA-2026:3337", "https://access.redhat.com/errata/RHSA-2026:3340", "https://access.redhat.com/errata/RHSA-2026:3341", "https://access.redhat.com/errata/RHSA-2026:3343", "https://access.redhat.com/errata/RHSA-2026:3391", "https://access.redhat.com/errata/RHSA-2026:3416", "https://access.redhat.com/errata/RHSA-2026:3427", "https://access.redhat.com/errata/RHSA-2026:3459", "https://access.redhat.com/errata/RHSA-2026:3468", "https://access.redhat.com/errata/RHSA-2026:3469", "https://access.redhat.com/errata/RHSA-2026:3470", "https://access.redhat.com/errata/RHSA-2026:3471", "https://access.redhat.com/errata/RHSA-2026:3472", "https://access.redhat.com/errata/RHSA-2026:3473", "https://access.redhat.com/errata/RHSA-2026:3489", "https://access.redhat.com/errata/RHSA-2026:3506", "https://access.redhat.com/errata/RHSA-2026:3556", "https://access.redhat.com/errata/RHSA-2026:3559", "https://access.redhat.com/errata/RHSA-2026:3668", "https://access.redhat.com/errata/RHSA-2026:3669", "https://access.redhat.com/errata/RHSA-2026:36873", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:3699", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:3752", "https://access.redhat.com/errata/RHSA-2026:3753", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3812", "https://access.redhat.com/errata/RHSA-2026:3813", "https://access.redhat.com/errata/RHSA-2026:3814", "https://access.redhat.com/errata/RHSA-2026:3815", "https://access.redhat.com/errata/RHSA-2026:3816", "https://access.redhat.com/errata/RHSA-2026:3817", "https://access.redhat.com/errata/RHSA-2026:3818", "https://access.redhat.com/errata/RHSA-2026:3820", "https://access.redhat.com/errata/RHSA-2026:3821", "https://access.redhat.com/errata/RHSA-2026:3822", "https://access.redhat.com/errata/RHSA-2026:3831", "https://access.redhat.com/errata/RHSA-2026:3833", "https://access.redhat.com/errata/RHSA-2026:3835", "https://access.redhat.com/errata/RHSA-2026:3836", "https://access.redhat.com/errata/RHSA-2026:3838", "https://access.redhat.com/errata/RHSA-2026:3839", "https://access.redhat.com/errata/RHSA-2026:3840", "https://access.redhat.com/errata/RHSA-2026:3841", "https://access.redhat.com/errata/RHSA-2026:3843", "https://access.redhat.com/errata/RHSA-2026:3854", "https://access.redhat.com/errata/RHSA-2026:3855", "https://access.redhat.com/errata/RHSA-2026:3856", "https://access.redhat.com/errata/RHSA-2026:3864", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3875", "https://access.redhat.com/errata/RHSA-2026:3879", "https://access.redhat.com/errata/RHSA-2026:3880", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3898", "https://access.redhat.com/errata/RHSA-2026:3905", "https://access.redhat.com/errata/RHSA-2026:3906", "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/errata/RHSA-2026:3929", "https://access.redhat.com/errata/RHSA-2026:3930", "https://access.redhat.com/errata/RHSA-2026:3931", "https://access.redhat.com/errata/RHSA-2026:3932", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:3970", "https://access.redhat.com/errata/RHSA-2026:3971", "https://access.redhat.com/errata/RHSA-2026:3972", "https://access.redhat.com/errata/RHSA-2026:3973", "https://access.redhat.com/errata/RHSA-2026:3974", "https://access.redhat.com/errata/RHSA-2026:3977", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:3985", "https://access.redhat.com/errata/RHSA-2026:40924", "https://access.redhat.com/errata/RHSA-2026:4164", "https://access.redhat.com/errata/RHSA-2026:4166", "https://access.redhat.com/errata/RHSA-2026:4170", "https://access.redhat.com/errata/RHSA-2026:4174", "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:4211", "https://access.redhat.com/errata/RHSA-2026:4220", "https://access.redhat.com/errata/RHSA-2026:4256", "https://access.redhat.com/errata/RHSA-2026:4264", "https://access.redhat.com/errata/RHSA-2026:4267", "https://access.redhat.com/errata/RHSA-2026:4270", "https://access.redhat.com/errata/RHSA-2026:4276", "https://access.redhat.com/errata/RHSA-2026:4434", "https://access.redhat.com/errata/RHSA-2026:4435", "https://access.redhat.com/errata/RHSA-2026:4460", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:4498", "https://access.redhat.com/errata/RHSA-2026:4500", "https://access.redhat.com/errata/RHSA-2026:4510", "https://access.redhat.com/errata/RHSA-2026:4511", "https://access.redhat.com/errata/RHSA-2026:4672", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:4753", "https://access.redhat.com/errata/RHSA-2026:4892", "https://access.redhat.com/errata/RHSA-2026:4901", "https://access.redhat.com/errata/RHSA-2026:4907", "https://access.redhat.com/errata/RHSA-2026:4939", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:4952", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5022", "https://access.redhat.com/errata/RHSA-2026:5030", "https://access.redhat.com/errata/RHSA-2026:5031", "https://access.redhat.com/errata/RHSA-2026:5076", "https://access.redhat.com/errata/RHSA-2026:5077", "https://access.redhat.com/errata/RHSA-2026:5078", "https://access.redhat.com/errata/RHSA-2026:5079", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:5129", "https://access.redhat.com/errata/RHSA-2026:5130", "https://access.redhat.com/errata/RHSA-2026:5131", "https://access.redhat.com/errata/RHSA-2026:5132", "https://access.redhat.com/errata/RHSA-2026:5145", "https://access.redhat.com/errata/RHSA-2026:5146", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5327", "https://access.redhat.com/errata/RHSA-2026:5394", "https://access.redhat.com/errata/RHSA-2026:5439", "https://access.redhat.com/errata/RHSA-2026:5444", "https://access.redhat.com/errata/RHSA-2026:5447", "https://access.redhat.com/errata/RHSA-2026:5452", "https://access.redhat.com/errata/RHSA-2026:5461", "https://access.redhat.com/errata/RHSA-2026:5463", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5533", "https://access.redhat.com/errata/RHSA-2026:5544", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:5636", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:5645", "https://access.redhat.com/errata/RHSA-2026:5649", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:5807", "https://access.redhat.com/errata/RHSA-2026:5851", "https://access.redhat.com/errata/RHSA-2026:5852", "https://access.redhat.com/errata/RHSA-2026:5853", "https://access.redhat.com/errata/RHSA-2026:5948", "https://access.redhat.com/errata/RHSA-2026:5950", "https://access.redhat.com/errata/RHSA-2026:5952", "https://access.redhat.com/errata/RHSA-2026:5968", "https://access.redhat.com/errata/RHSA-2026:6184", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:6226", "https://access.redhat.com/errata/RHSA-2026:6251", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6429", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6554", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:7052", "https://access.redhat.com/errata/RHSA-2026:7249", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7676", "https://access.redhat.com/errata/RHSA-2026:7854", "https://access.redhat.com/errata/RHSA-2026:7942", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:8229", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8431", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2025-61726", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://go.dev/cl/736712", "https://go.dev/issue/77101", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-61726.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61726", "https://pkg.go.dev/vuln/GO-2026-4341", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "https://www.cve.org/CVERecord?id=CVE-2025-61726" ], "PublishedDate": "2026-01-28T20:16:09.713Z", "LastModifiedDate": "2026-09-17T12:17:11.443Z" }, { "VulnerabilityID": "CVE-2025-61729", "VendorIDs": [ "GO-2025-4155" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.24.11, 1.25.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61729", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fc7108739aca205a0db99d1f57577dfa3b8b5532efad491ea285e6944bfeafb5", "Title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "Description": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/security/cve/CVE-2025-61729", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-3928.html", "https://errata.rockylinux.org/RLSA-2026:3928", "https://go.dev/cl/725920", "https://go.dev/issue/76445", "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "https://linux.oracle.com/cve/CVE-2025-61729.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61729", "https://pkg.go.dev/vuln/GO-2025-4155", "https://www.cve.org/CVERecord?id=CVE-2025-61729" ], "PublishedDate": "2025-12-02T19:15:51.447Z", "LastModifiedDate": "2026-10-18T18:10:00.1Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c0d1fa36c872b54fd415b39956587c2327909f95a62df47ab8f09a2db1ab907f", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-25679", "VendorIDs": [ "GO-2026-4601" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.8, 1.26.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25679", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1f5fe5675a10506cc0a45518744c2d70a6a3f503f27a975eadbfb6caa83ccea3", "Title": "net/url: Incorrect parsing of IPv6 host literals in net/url", "Description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "Severity": "HIGH", "CweIDs": [ "CWE-425", "CWE-1286" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10133", "https://access.redhat.com/errata/RHSA-2026:10140", "https://access.redhat.com/errata/RHSA-2026:10141", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10169", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:10701", "https://access.redhat.com/errata/RHSA-2026:10712", "https://access.redhat.com/errata/RHSA-2026:10929", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11375", "https://access.redhat.com/errata/RHSA-2026:11412", "https://access.redhat.com/errata/RHSA-2026:11413", "https://access.redhat.com/errata/RHSA-2026:11686", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:11800", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13642", "https://access.redhat.com/errata/RHSA-2026:13643", "https://access.redhat.com/errata/RHSA-2026:13671", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19022", "https://access.redhat.com/errata/RHSA-2026:19026", "https://access.redhat.com/errata/RHSA-2026:19027", "https://access.redhat.com/errata/RHSA-2026:19031", "https://access.redhat.com/errata/RHSA-2026:19032", "https://access.redhat.com/errata/RHSA-2026:19049", "https://access.redhat.com/errata/RHSA-2026:19055", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19128", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19181", "https://access.redhat.com/errata/RHSA-2026:19184", "https://access.redhat.com/errata/RHSA-2026:19185", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19475", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20581", "https://access.redhat.com/errata/RHSA-2026:20582", "https://access.redhat.com/errata/RHSA-2026:20584", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22733", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24386", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:25043", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26445", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52389", "https://access.redhat.com/errata/RHSA-2026:52390", "https://access.redhat.com/errata/RHSA-2026:52391", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:5941", "https://access.redhat.com/errata/RHSA-2026:5942", "https://access.redhat.com/errata/RHSA-2026:5943", "https://access.redhat.com/errata/RHSA-2026:5944", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:6341", "https://access.redhat.com/errata/RHSA-2026:6344", "https://access.redhat.com/errata/RHSA-2026:6382", "https://access.redhat.com/errata/RHSA-2026:6383", "https://access.redhat.com/errata/RHSA-2026:6388", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:6949", "https://access.redhat.com/errata/RHSA-2026:7005", "https://access.redhat.com/errata/RHSA-2026:7009", "https://access.redhat.com/errata/RHSA-2026:7011", "https://access.redhat.com/errata/RHSA-2026:7259", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7315", "https://access.redhat.com/errata/RHSA-2026:7328", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7665", "https://access.redhat.com/errata/RHSA-2026:7669", "https://access.redhat.com/errata/RHSA-2026:7674", "https://access.redhat.com/errata/RHSA-2026:7833", "https://access.redhat.com/errata/RHSA-2026:7834", "https://access.redhat.com/errata/RHSA-2026:7876", "https://access.redhat.com/errata/RHSA-2026:7877", "https://access.redhat.com/errata/RHSA-2026:7878", "https://access.redhat.com/errata/RHSA-2026:7879", "https://access.redhat.com/errata/RHSA-2026:7883", "https://access.redhat.com/errata/RHSA-2026:7992", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8314", "https://access.redhat.com/errata/RHSA-2026:8322", "https://access.redhat.com/errata/RHSA-2026:8324", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8434", "https://access.redhat.com/errata/RHSA-2026:8456", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:8840", "https://access.redhat.com/errata/RHSA-2026:8841", "https://access.redhat.com/errata/RHSA-2026:8842", "https://access.redhat.com/errata/RHSA-2026:8845", "https://access.redhat.com/errata/RHSA-2026:8847", "https://access.redhat.com/errata/RHSA-2026:8848", "https://access.redhat.com/errata/RHSA-2026:8849", "https://access.redhat.com/errata/RHSA-2026:8851", "https://access.redhat.com/errata/RHSA-2026:8852", "https://access.redhat.com/errata/RHSA-2026:8853", "https://access.redhat.com/errata/RHSA-2026:8855", "https://access.redhat.com/errata/RHSA-2026:8856", "https://access.redhat.com/errata/RHSA-2026:8860", "https://access.redhat.com/errata/RHSA-2026:8877", "https://access.redhat.com/errata/RHSA-2026:8878", "https://access.redhat.com/errata/RHSA-2026:8879", "https://access.redhat.com/errata/RHSA-2026:8881", "https://access.redhat.com/errata/RHSA-2026:8882", "https://access.redhat.com/errata/RHSA-2026:8930", "https://access.redhat.com/errata/RHSA-2026:8931", "https://access.redhat.com/errata/RHSA-2026:8949", "https://access.redhat.com/errata/RHSA-2026:9043", "https://access.redhat.com/errata/RHSA-2026:9044", "https://access.redhat.com/errata/RHSA-2026:9052", "https://access.redhat.com/errata/RHSA-2026:9090", "https://access.redhat.com/errata/RHSA-2026:9093", "https://access.redhat.com/errata/RHSA-2026:9094", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9434", "https://access.redhat.com/errata/RHSA-2026:9435", "https://access.redhat.com/errata/RHSA-2026:9436", "https://access.redhat.com/errata/RHSA-2026:9439", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9461", "https://access.redhat.com/errata/RHSA-2026:9695", "https://access.redhat.com/errata/RHSA-2026:9742", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-25679", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://errata.almalinux.org/9/ALSA-2026-9044.html", "https://errata.rockylinux.org/RLSA-2026:9044", "https://go.dev/cl/752180", "https://go.dev/issue/77578", "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "https://linux.oracle.com/cve/CVE-2026-25679.html", "https://linux.oracle.com/errata/ELSA-2026-9044.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "https://pkg.go.dev/vuln/GO-2026-4601", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json", "https://www.cve.org/CVERecord?id=CVE-2026-25679" ], "PublishedDate": "2026-03-06T22:16:00.72Z", "LastModifiedDate": "2026-09-18T13:17:30.067Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:de309220a1247f620d28bcd281932a87d889182915254c169493579016301514", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:105965eed7322a34a9e5281377323c32a25488ac57ff225ee6a09abea4616ee3", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:67cce963bc097856b95d4af35dc71ee839242ce030b47474cfbce0d7d49e6205", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:74d9a8873e42d0b957a198e2f825214410d63ba2519dd6aaaafd7ac67ad1cec4", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b32182ef3c23c8b59757d5ff09b39d430ad45ede5efa2a7a1cc241eec317a62f", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:449bd5185ee70c1dbd82769cd326d5b1d1ad3325e72af16ecf36316eaedd347b", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:745bd1e9caf37b6f0c9f61e8b2a874bfa163689a7f2b75950d7b94b806d932cb", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fbfd3733870fc652823e3db016b1f5932cd42423ba5be5a80b3d3b372b7cbd6e", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6ffbeda92823afe41fbc86cdcbdc657a430ee8c5159f5a94dbdfdb791e9e092b", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e1489ee981bf25b847a533e7b00ddfdf243e97bcbe59b46b67254b922ba95675", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:397501c6e9d419d86a1c1e420b5286dc3491de3dd42b6defff6522975af695ae", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4cd2f7f93eba5981bbfbd7b8b3e97bbe2f962e3e21c31687ae14511a2f7afccb", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d3f21a87f385aea1497b13dd2dc8ff139b6d9357136596d5e649ffd92efce97c", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f710278a5576897c72811786dc441e9ad652e85ffd5a747bb74f9ce250649f88", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8d2dedbfb906cad22cd400de833c4d1086217ed6e1c51211a8aded2a268addc3", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:824c2d3c3a1ea3e059c142067b1aae5b4c6fbaec3d2e46b01fe27fa7422a4eff", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ca93699884d90160ffc4ab1eadff71e708b6bc1c369f3da86b84ccf692019e32", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f62d372a25ca5c02489b53674b5d4e76a8b9c3b75bff4c919573a78b09e58f43", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:53454fb69605820a91d1bcf96598c7a13d827e5d9b078189211b276996fddcc6", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a58dbb0a996b8430978a681920d944d591be00b4f2a04494b950f911b88d7bd5", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.23.12", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.12", "UID": "306f34c69efd119f" }, "InstalledVersion": "v1.23.12", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6abe8b92d601817927a9a8ae865603b6087fd395eadb2d76d74060374204033d", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] }, { "Target": "app/node_modules/.bun/lefthook-linux-x64@2.1.4/node_modules/lefthook-linux-x64/bin/lefthook", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/evilmartians/lefthook/v2@v2.1.4", "Name": "github.com/evilmartians/lefthook/v2", "Identifier": { "PURL": "pkg:golang/github.com/evilmartians/lefthook/v2@v2.1.4", "UID": "fa2e3ee46fc86641" }, "Version": "v2.1.4", "Relationship": "root", "DependsOn": [ "github.com/alessio/shellescape@v1.4.1", "github.com/aymanbagabas/go-osc52/v2@v2.0.1", "github.com/bmatcuk/doublestar/v4@v4.10.0", "github.com/briandowns/spinner@v1.23.2", "github.com/charmbracelet/colorprofile@v0.2.3-0.20250311203215-f60798e515dc", "github.com/charmbracelet/lipgloss@v1.1.0", "github.com/charmbracelet/x/ansi@v0.8.0", "github.com/charmbracelet/x/cellbuf@v0.0.13-0.20250311204145-2c3ea96c31dd", "github.com/charmbracelet/x/term@v0.2.1", "github.com/clipperhouse/uax29/v2@v2.2.0", "github.com/creack/pty@v1.1.24", "github.com/fatih/color@v1.18.0", "github.com/gabriel-vasile/mimetype@v1.4.13", "github.com/go-json-experiment/json@v0.0.0-20260214004413-d219187c3433", "github.com/go-viper/mapstructure/v2@v2.4.0", "github.com/gobwas/glob@v0.2.3", "github.com/goccy/go-yaml@v1.19.2", "github.com/kaptinlin/go-i18n@v0.2.12", "github.com/kaptinlin/jsonpointer@v0.4.17", "github.com/kaptinlin/jsonschema@v0.7.5", "github.com/kaptinlin/messageformat-go@v0.4.18", "github.com/knadh/koanf/maps@v0.1.2", "github.com/knadh/koanf/parsers/json@v1.0.0", "github.com/knadh/koanf/parsers/toml/v2@v2.2.0", "github.com/knadh/koanf/parsers/yaml@v1.1.0", "github.com/knadh/koanf/providers/fs@v1.0.0", "github.com/knadh/koanf/providers/rawbytes@v1.0.0", "github.com/knadh/koanf/v2@v2.3.2", "github.com/lucasb-eyer/go-colorful@v1.2.0", "github.com/mattn/go-colorable@v0.1.13", "github.com/mattn/go-isatty@v0.0.20", "github.com/mattn/go-runewidth@v0.0.20", "github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db", "github.com/mitchellh/copystructure@v1.2.0", "github.com/mitchellh/mapstructure@v1.5.0", "github.com/mitchellh/reflectwalk@v1.0.2", "github.com/muesli/termenv@v0.16.0", "github.com/pelletier/go-toml/v2@v2.2.4", "github.com/rivo/uniseg@v0.4.7", "github.com/schollz/progressbar/v3@v3.19.0", "github.com/spf13/afero@v1.15.0", "github.com/tidwall/jsonc@v0.3.2", "github.com/urfave/cli/v3@v3.7.0", "github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e", "go.yaml.in/yaml/v3@v3.0.4", "golang.org/x/mod@v0.33.0", "golang.org/x/sys@v0.41.0", "golang.org/x/term@v0.40.0", "golang.org/x/text@v0.34.0", "stdlib@v1.26.1" ], "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.26.1", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "Version": "v1.26.1", "Relationship": "direct", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/alessio/shellescape@v1.4.1", "Name": "github.com/alessio/shellescape", "Identifier": { "PURL": "pkg:golang/github.com/alessio/shellescape@v1.4.1", "UID": "95751458131b6a4" }, "Version": "v1.4.1", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aymanbagabas/go-osc52/v2@v2.0.1", "Name": "github.com/aymanbagabas/go-osc52/v2", "Identifier": { "PURL": "pkg:golang/github.com/aymanbagabas/go-osc52/v2@v2.0.1", "UID": "4b71142bb3362a7b" }, "Version": "v2.0.1", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bmatcuk/doublestar/v4@v4.10.0", "Name": "github.com/bmatcuk/doublestar/v4", "Identifier": { "PURL": "pkg:golang/github.com/bmatcuk/doublestar/v4@v4.10.0", "UID": "9ea0e69f624a3ccb" }, "Version": "v4.10.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/briandowns/spinner@v1.23.2", "Name": "github.com/briandowns/spinner", "Identifier": { "PURL": "pkg:golang/github.com/briandowns/spinner@v1.23.2", "UID": "ea74397339107448" }, "Version": "v1.23.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/charmbracelet/colorprofile@v0.2.3-0.20250311203215-f60798e515dc", "Name": "github.com/charmbracelet/colorprofile", "Identifier": { "PURL": "pkg:golang/github.com/charmbracelet/colorprofile@v0.2.3-0.20250311203215-f60798e515dc", "UID": "dc31eac39e1a981d" }, "Version": "v0.2.3-0.20250311203215-f60798e515dc", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/charmbracelet/lipgloss@v1.1.0", "Name": "github.com/charmbracelet/lipgloss", "Identifier": { "PURL": "pkg:golang/github.com/charmbracelet/lipgloss@v1.1.0", "UID": "42d0de66969195e2" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/charmbracelet/x/ansi@v0.8.0", "Name": "github.com/charmbracelet/x/ansi", "Identifier": { "PURL": "pkg:golang/github.com/charmbracelet/x/ansi@v0.8.0", "UID": "3672fdf79ab2ab3d" }, "Version": "v0.8.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/charmbracelet/x/cellbuf@v0.0.13-0.20250311204145-2c3ea96c31dd", "Name": "github.com/charmbracelet/x/cellbuf", "Identifier": { "PURL": "pkg:golang/github.com/charmbracelet/x/cellbuf@v0.0.13-0.20250311204145-2c3ea96c31dd", "UID": "8ddcc5b68ddadcc5" }, "Version": "v0.0.13-0.20250311204145-2c3ea96c31dd", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/charmbracelet/x/term@v0.2.1", "Name": "github.com/charmbracelet/x/term", "Identifier": { "PURL": "pkg:golang/github.com/charmbracelet/x/term@v0.2.1", "UID": "cc3c97dd290dd5ff" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/clipperhouse/uax29/v2@v2.2.0", "Name": "github.com/clipperhouse/uax29/v2", "Identifier": { "PURL": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.2.0", "UID": "d9f08e768cdff890" }, "Version": "v2.2.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/creack/pty@v1.1.24", "Name": "github.com/creack/pty", "Identifier": { "PURL": "pkg:golang/github.com/creack/pty@v1.1.24", "UID": "a5fdfdb3bcf4c21e" }, "Version": "v1.1.24", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.18.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.18.0", "UID": "b63d104443eaa46c" }, "Version": "v1.18.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gabriel-vasile/mimetype@v1.4.13", "Name": "github.com/gabriel-vasile/mimetype", "Identifier": { "PURL": "pkg:golang/github.com/gabriel-vasile/mimetype@v1.4.13", "UID": "920a4cec439d35c" }, "Version": "v1.4.13", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-json-experiment/json@v0.0.0-20260214004413-d219187c3433", "Name": "github.com/go-json-experiment/json", "Identifier": { "PURL": "pkg:golang/github.com/go-json-experiment/json@v0.0.0-20260214004413-d219187c3433", "UID": "1c7dcbda95af0d1c" }, "Version": "v0.0.0-20260214004413-d219187c3433", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-viper/mapstructure/v2@v2.4.0", "Name": "github.com/go-viper/mapstructure/v2", "Identifier": { "PURL": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.4.0", "UID": "69b94bf3e270d32a" }, "Version": "v2.4.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobwas/glob@v0.2.3", "Name": "github.com/gobwas/glob", "Identifier": { "PURL": "pkg:golang/github.com/gobwas/glob@v0.2.3", "UID": "cca7733249912d69" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/goccy/go-yaml@v1.19.2", "Name": "github.com/goccy/go-yaml", "Identifier": { "PURL": "pkg:golang/github.com/goccy/go-yaml@v1.19.2", "UID": "b1eb8f1cb0a76fd9" }, "Version": "v1.19.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kaptinlin/go-i18n@v0.2.12", "Name": "github.com/kaptinlin/go-i18n", "Identifier": { "PURL": "pkg:golang/github.com/kaptinlin/go-i18n@v0.2.12", "UID": "33dafa03378de82d" }, "Version": "v0.2.12", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kaptinlin/jsonpointer@v0.4.17", "Name": "github.com/kaptinlin/jsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/kaptinlin/jsonpointer@v0.4.17", "UID": "d618be6e1e1babb6" }, "Version": "v0.4.17", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kaptinlin/jsonschema@v0.7.5", "Name": "github.com/kaptinlin/jsonschema", "Identifier": { "PURL": "pkg:golang/github.com/kaptinlin/jsonschema@v0.7.5", "UID": "4d9474aa0bcb3629" }, "Version": "v0.7.5", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kaptinlin/messageformat-go@v0.4.18", "Name": "github.com/kaptinlin/messageformat-go", "Identifier": { "PURL": "pkg:golang/github.com/kaptinlin/messageformat-go@v0.4.18", "UID": "e4caae9ab8db52e0" }, "Version": "v0.4.18", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/maps@v0.1.2", "Name": "github.com/knadh/koanf/maps", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/maps@v0.1.2", "UID": "74efa3961b517298" }, "Version": "v0.1.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/parsers/json@v1.0.0", "Name": "github.com/knadh/koanf/parsers/json", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/parsers/json@v1.0.0", "UID": "47e2448903dadc53" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/parsers/toml/v2@v2.2.0", "Name": "github.com/knadh/koanf/parsers/toml/v2", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/parsers/toml/v2@v2.2.0", "UID": "7dcd25d8052e2217" }, "Version": "v2.2.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/parsers/yaml@v1.1.0", "Name": "github.com/knadh/koanf/parsers/yaml", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/parsers/yaml@v1.1.0", "UID": "5b4b359795a2b20f" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/providers/fs@v1.0.0", "Name": "github.com/knadh/koanf/providers/fs", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/providers/fs@v1.0.0", "UID": "9097ffeb1b56f988" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/providers/rawbytes@v1.0.0", "Name": "github.com/knadh/koanf/providers/rawbytes", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/providers/rawbytes@v1.0.0", "UID": "85df6e083431f222" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knadh/koanf/v2@v2.3.2", "Name": "github.com/knadh/koanf/v2", "Identifier": { "PURL": "pkg:golang/github.com/knadh/koanf/v2@v2.3.2", "UID": "119f344b1fa2c510" }, "Version": "v2.3.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lucasb-eyer/go-colorful@v1.2.0", "Name": "github.com/lucasb-eyer/go-colorful", "Identifier": { "PURL": "pkg:golang/github.com/lucasb-eyer/go-colorful@v1.2.0", "UID": "35a81728afd73f5c" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.13", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.13", "UID": "3ab4bb88d2b2cfa8" }, "Version": "v0.1.13", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.20", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "UID": "c277aac310817565" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-runewidth@v0.0.20", "Name": "github.com/mattn/go-runewidth", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-runewidth@v0.0.20", "UID": "17cbbd63f25946e4" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db", "Name": "github.com/mitchellh/colorstring", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db", "UID": "d241a4bc6cf26c99" }, "Version": "v0.0.0-20190213212951-d06e56a500db", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/copystructure@v1.2.0", "Name": "github.com/mitchellh/copystructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0", "UID": "15af0235029a0411" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/mapstructure@v1.5.0", "Name": "github.com/mitchellh/mapstructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "UID": "b005e4a623d105e8" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/reflectwalk@v1.0.2", "Name": "github.com/mitchellh/reflectwalk", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2", "UID": "96edf5af86d8e058" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/muesli/termenv@v0.16.0", "Name": "github.com/muesli/termenv", "Identifier": { "PURL": "pkg:golang/github.com/muesli/termenv@v0.16.0", "UID": "f517be6e961881c8" }, "Version": "v0.16.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pelletier/go-toml/v2@v2.2.4", "Name": "github.com/pelletier/go-toml/v2", "Identifier": { "PURL": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", "UID": "f57781841d525382" }, "Version": "v2.2.4", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rivo/uniseg@v0.4.7", "Name": "github.com/rivo/uniseg", "Identifier": { "PURL": "pkg:golang/github.com/rivo/uniseg@v0.4.7", "UID": "4a3d0c7df6f9ed7c" }, "Version": "v0.4.7", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/schollz/progressbar/v3@v3.19.0", "Name": "github.com/schollz/progressbar/v3", "Identifier": { "PURL": "pkg:golang/github.com/schollz/progressbar/v3@v3.19.0", "UID": "10ff53e688f38006" }, "Version": "v3.19.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/afero@v1.15.0", "Name": "github.com/spf13/afero", "Identifier": { "PURL": "pkg:golang/github.com/spf13/afero@v1.15.0", "UID": "cb70b0967ac4006" }, "Version": "v1.15.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tidwall/jsonc@v0.3.2", "Name": "github.com/tidwall/jsonc", "Identifier": { "PURL": "pkg:golang/github.com/tidwall/jsonc@v0.3.2", "UID": "e06b106d368da1e0" }, "Version": "v0.3.2", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/urfave/cli/v3@v3.7.0", "Name": "github.com/urfave/cli/v3", "Identifier": { "PURL": "pkg:golang/github.com/urfave/cli/v3@v3.7.0", "UID": "fc963a7b1aa2f07f" }, "Version": "v3.7.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e", "Name": "github.com/xo/terminfo", "Identifier": { "PURL": "pkg:golang/github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e", "UID": "c1896d38b83c56a9" }, "Version": "v0.0.0-20220910002029-abceb7e1c41e", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v3@v3.0.4", "Name": "go.yaml.in/yaml/v3", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", "UID": "4d6c6874e76b5887" }, "Version": "v3.0.4", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/mod@v0.33.0", "Name": "golang.org/x/mod", "Identifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.33.0", "UID": "3c153de0f38b319a" }, "Version": "v0.33.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.41.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.41.0", "UID": "5a387704ce2c827" }, "Version": "v0.41.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/term@v0.40.0", "Name": "golang.org/x/term", "Identifier": { "PURL": "pkg:golang/golang.org/x/term@v0.40.0", "UID": "ddafaa8ac5fd0e26" }, "Version": "v0.40.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.34.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.34.0", "UID": "f21355110825b29a" }, "Version": "v0.34.0", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-56864", "VendorIDs": [ "GO-2026-6180" ], "PkgID": "golang.org/x/mod@v0.33.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.33.0", "UID": "3c153de0f38b319a" }, "InstalledVersion": "v0.33.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56864", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0e80f38b891922a0235fb6938021a7732716ebedc48f142d9acf7f5640292a99", "Title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "Description": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "photon": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56864", "https://go.dev/cl/815000", "https://go.dev/cl/815020", "https://go.dev/issue/80745", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56864", "https://pkg.go.dev/vuln/GO-2026-6180", "https://www.cve.org/CVERecord?id=CVE-2026-56864" ], "PublishedDate": "2026-08-13T22:17:22.677Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56865", "VendorIDs": [ "GO-2026-6179" ], "PkgID": "golang.org/x/mod@v0.33.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.33.0", "UID": "3c153de0f38b319a" }, "InstalledVersion": "v0.33.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56865", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1152dcaffad0d9979ebe5ea084ebf05cc706fe20fcf0bb7fb144e4fb5997b8e4", "Title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "Description": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bitnami": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56865", "https://github.com/golang/go/issues/80744", "https://go.dev/cl/814960", "https://go.dev/cl/815020", "https://go.dev/issue/80744", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56865", "https://pkg.go.dev/vuln/GO-2026-6179", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56865" ], "PublishedDate": "2026-08-13T22:17:22.797Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.34.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.34.0", "UID": "f21355110825b29a" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e5ed5d0bffc7c1d58e828abb9d21e3a65a043f1b00fff87fa3844a1701b0af1c", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.34.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.34.0", "UID": "f21355110825b29a" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bb9817abf3d7dcec2b7c4a396738fcfeba0fcd24de97a5ff46ab5aaa0dfc0441", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3d3fc29e5a2ce7c0b1f28a606b8c0d03fc49b2d897e06b5a3f9c53b3601161af", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:361bbe73ad8f2d46273ca555d19b25a6eb93482a043d4f0bbf495547488b4521", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d57b6441c8a27746e20824b8c82c28e0d51db09b6ab89d5d4c64ca3ed384683f", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:65d24c65a83c3f860500452b0ecbd39e27040d3c50720170cc2a719e65aa0f0e", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:23d90516552ba1e1f694486cd0e36212bb63b6fbc8aaa54e7800b003355f85f3", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33810", "VendorIDs": [ "GO-2026-4866" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33810", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8530b6322d923e445c0d537f201f0101c9eb8f21a58d4d3150579fa3373a8951", "Title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application", "Description": "When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-1289" ], "VendorSeverity": { "alma": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "V3Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "V3Score": 8.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/19/4", "http://www.openwall.com/lists/oss-security/2026/04/20/1", "https://access.redhat.com/errata/RHSA-2026:10155", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:57126", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:62577", "https://access.redhat.com/errata/RHSA-2026:62578", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65880", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67134", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67518", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-33810", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2449833", "https://bugzilla.redhat.com/2455470", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2456336", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2449833", "https://bugzilla.redhat.com/show_bug.cgi?id=2455470", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986", "https://errata.almalinux.org/9/ALSA-2026-19353.html", "https://errata.rockylinux.org/RLSA-2026:19353", "https://go.dev/cl/763763", "https://go.dev/issue/78332", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-33810.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33810", "https://pkg.go.dev/vuln/GO-2026-4866", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json", "https://www.cve.org/CVERecord?id=CVE-2026-33810" ], "PublishedDate": "2026-04-08T02:16:03.95Z", "LastModifiedDate": "2026-09-18T13:17:56.113Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a9bb8b1f0d4667a96bcfa802bab01177df669bcc24b6e2a25b84b5afa1b8fb2b", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f5aadf82d3f2becec16618e515f71e0a08dedfde6e12d25fd2153f1353083d15", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5ec42f487098fc7e93cbd45e2308a570dfcba3452bc7805b4d3bde20ccc4ac78", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:195fb651d9ca7d09a858e83c86b11548216bbfc22c0c579e4b42057b8622bc8d", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9bd7af1f87167fe1b9bf80ea42a6b924d6c1422bae38d152759809b6c1c5b4b8", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e1f0a31791afad9d14dfa511e0f0d1f415080b5f45a58ba72deedff3ea7190af", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:aa290526771ca5c4bb628ff302d8bd947ec62f85c1ef29bac980f71cd31ab692", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1ea70eb2ef9eb11174cab1264075003325de53df277e1ef7ad23f8f72c212ab0", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f648748de4ede60d265081b60d37a1cb2b203cdf1d35956b819c94ac80d55326", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:defba44e30a5e8622d6a2732ec6286954794374373b8adaf6b614f439ce2b985", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:20f2c685a859c6379609f7021c7cf15e5f557ef23b7d01f95d37dec90464ec49", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:472d238477d28c67066cde97f7e936baba6192935a75ce3fbe60f04706de74c4", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3bbebe52ee25ad6e9113d411c7637f15762b9aa609a45f167ac18c94828edfde", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1d6449371a1514eb6fa3148ecc7ce05e64ca5763eeeac90b53ed25e24808be0a", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:872f040d20d23f4267af930a08981d8d690a5b3036af824ca92a8ed9765bd749", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5596572e52a72d56d7e915212fa380d718c89072c2829e6fab409373fbd91f06", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e67112773e3c8af55189b0691160ec50953ee75e4a8fc840066b6b75c70f8b8b", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.26.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.1", "UID": "34d593ff3b26570e" }, "InstalledVersion": "v1.26.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3a78ac6df5a4a442a5a25124471e609ae1a094d8f202742e0458cc4f5b3ab802" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:926eb6cc381ff63bd59072e4168c261c6182c41512ff635e3c73b2aba89abca3", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }