Most recent entries from all

cnvd-2018-04545

EUVD-2026-178992

fkie_cve-2017-18077

index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

GHSA-832h-xg76-4gv6 — ReDoS in brace-expansion

Affected: npm: brace-expansion

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

``` var expand = require('brace-expansion'); expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}'); ```

## Recommendation

Update to version 1.1.7 or later.

gsd-2017-18077

RHSA-2020:2625 — Red Hat Security Advisory: rh-nodejs8-nodejs security update

nodejs-brace-expansion: Regular expression denial of service nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

WID-SEC-W-2026-2183 — Red Hat Software Collections: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Software Collections ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden.