Most recent entries from all

ALSA-2026:7080 — Important: nodejs22 security update

Affected: AlmaLinux:10: nodejs-docs

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the Re…

bdu:2026-01718

certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0199

Withdrawn: CLEANSTART-2026-CD42505 — Security fixes in npm 11.8.0-r0

Withdrawn by the publisher.

Affected: CleanStart: npm

Package npm version 11.8.0-r0 fixes 1 vulnerabilities: CVE-2026-25547

EUVD-2026-267425

fkie_cve-2026-25547

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

GHSA-7h2j-956f-4vf2 — @isaacs/brace-expansion has Uncontrolled Resource Consumption

Affected: npm: @isaacs/brace-expansion

### Summary

`@isaacs/brace-expansion` is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.

### Details

The vulnerability occurs because `@isaacs/brace-expansion` expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller.

For example, the following input:

``` {0..99}{0..99}{0..99}{0..99}{0..99} ```

produces:

``` 100^5 = 10,000,000,000 combinations ```

This exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination.

### Proof of Concept

The following script reliably triggers the issue.

Create `poc.js`:

```js const { expand } = require('@isaacs/brace-expansion');

const pattern = '{0..99}{0..99}{0..99}{0..99}{0..99}';

console.log('Starting expansion...'); expand(pattern); ```

Run it:

```bash node poc.js ```

The process will freeze and typically crash with an error such as:

``` FATAL ERROR: JavaScript heap out of memory ```

### Impact

This is a denial of service vulnerability. Any application or downstream dependency that uses `@isaacs/brace-expa…

openSUSE-SU-2026:10168-1 — openQA-5.1770718745.ce2072d3-1.1 on GA media

openQA-5.1770718745.ce2072d3-1.1 on GA media

RHSA-2026:7310 — Red Hat Security Advisory: nodejs22 security update

undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion minimatch: minimatch: Denial of Service via specially crafted glob patterns nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions

SUSE-SU-2026:1013-1 — Security update 5.0.7 for Multi-Linux Manager Client Tools

Security update 5.0.7 for Multi-Linux Manager Client Tools

UBUNTU-CVE-2026-25547

Affected: Ubuntu:18.04:LTS: node-brace-expansion, Ubuntu:20.04:LTS: node-brace-expansion, Ubuntu:22.04:LTS: node-brace-expansion, Ubuntu:24.04:LTS: node-brace-expansion, Ubuntu:25.10: node-brace-expansion, Ubuntu:26.04:LTS: node-brace-expansion

WID-SEC-W-2026-0526 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.