Vulnerability-Lookup

RHSA-2026:58819

Vulnerability from csaf_opensuse - Published: 2026-08-24 00:00 - Updated: 2026-08-24 00:00

Summary

security update for nodejs24

Severity

Important

Notes

Title of the patch: security update for nodejs24

Description of the patch: This security update provides a functional equivalent of RHSA-2026:58819. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:58819.

Patchnames: RHSA-2026:58819

CVE-2026-14257

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-54272

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-69152

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-69192

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch	—	Vendor Fix

Threats

Impact moderate

References

15 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2026-14257/	self
https://www.suse.com/security/cve/CVE-2026-54272/	self
https://www.suse.com/security/cve/CVE-2026-69152/	self
https://www.suse.com/security/cve/CVE-2026-69192/	self
https://www.suse.com/security/cve/CVE-2026-14257	external
https://bugzilla.suse.com/1272738	external
https://bugzilla.suse.com/1276011	external
https://www.suse.com/security/cve/CVE-2026-54272	external
https://bugzilla.suse.com/1272881	external
https://www.suse.com/security/cve/CVE-2026-69152	external
https://bugzilla.suse.com/1276011	external
https://www.suse.com/security/cve/CVE-2026-69192	external
https://bugzilla.suse.com/1273556	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for nodejs24",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:58819.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:58819.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:58819",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_58819.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-14257 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-14257/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54272 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54272/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-69152 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-69152/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-69192 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-69192/"
      }
    ],
    "title": "security update for nodejs24",
    "tracking": {
      "current_release_date": "2026-08-24T00:00:00Z",
      "generator": {
        "date": "2026-08-24T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:58819",
      "initial_release_date": "2026-08-24T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-24T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-docs-24.18.0-5.el10_2.noarch",
                "product": {
                  "name": "nodejs24-docs-24.18.0-5.el10_2.noarch",
                  "product_id": "nodejs24-docs-24.18.0-5.el10_2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch",
                "product": {
                  "name": "nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch",
                  "product_id": "nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-24.18.0-5.el10_2.x86_64",
                "product": {
                  "name": "nodejs24-24.18.0-5.el10_2.x86_64",
                  "product_id": "nodejs24-24.18.0-5.el10_2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-devel-24.18.0-5.el10_2.x86_64",
                "product": {
                  "name": "nodejs24-devel-24.18.0-5.el10_2.x86_64",
                  "product_id": "nodejs24-devel-24.18.0-5.el10_2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
                "product": {
                  "name": "nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
                  "product_id": "nodejs24-full-i18n-24.18.0-5.el10_2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs24-libs-24.18.0-5.el10_2.x86_64",
                "product": {
                  "name": "nodejs24-libs-24.18.0-5.el10_2.x86_64",
                  "product_id": "nodejs24-libs-24.18.0-5.el10_2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 10",
                "product": {
                  "name": "SUSE Liberty Linux 10",
                  "product_id": "SUSE Liberty Linux 10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-24.18.0-5.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64"
        },
        "product_reference": "nodejs24-24.18.0-5.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-devel-24.18.0-5.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64"
        },
        "product_reference": "nodejs24-devel-24.18.0-5.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-docs-24.18.0-5.el10_2.noarch as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch"
        },
        "product_reference": "nodejs24-docs-24.18.0-5.el10_2.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-full-i18n-24.18.0-5.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64"
        },
        "product_reference": "nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-libs-24.18.0-5.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64"
        },
        "product_reference": "nodejs24-libs-24.18.0-5.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
        },
        "product_reference": "nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14257",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-14257"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (\u0027{a,b}\u0027.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
          "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-14257",
          "url": "https://www.suse.com/security/cve/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272738 for CVE-2026-14257",
          "url": "https://bugzilla.suse.com/1272738"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276011 for CVE-2026-14257",
          "url": "https://bugzilla.suse.com/1276011"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-14257"
    },
    {
      "cve": "CVE-2026-54272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 ... labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
          "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54272",
          "url": "https://www.suse.com/security/cve/CVE-2026-54272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272881 for CVE-2026-54272",
          "url": "https://bugzilla.suse.com/1272881"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54272"
    },
    {
      "cve": "CVE-2026-69152",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-69152"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
          "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-69152",
          "url": "https://www.suse.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276011 for CVE-2026-69152",
          "url": "https://bugzilla.suse.com/1276011"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-69152"
    },
    {
      "cve": "CVE-2026-69192",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-69192"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4(\u0027012.0.0.1\u0027) reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch(\u0027http://012.0.0.1/\u0027) connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
          "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
          "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-69192",
          "url": "https://www.suse.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273556 for CVE-2026-69192",
          "url": "https://bugzilla.suse.com/1273556"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:nodejs24-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-devel-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-docs-24.18.0-5.el10_2.noarch",
            "SUSE Liberty Linux 10:nodejs24-full-i18n-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-libs-24.18.0-5.el10_2.x86_64",
            "SUSE Liberty Linux 10:nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-69192"
    }
  ]
}

CVE-2026-14257 (GCVE-0-2026-14257)

Vulnerability from cvelistv5 – Published: 2026-07-23 12:54 – Updated: 2026-07-23 14:44

Title

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

Summary

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:44 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

seal mitre root

References

3 references

URL	Tags
https://www.npmjs.com/package/brace-expansion
https://github.com/juliangruber/brace-expansion
https://github.com/juliangruber/brace-expansion/c…

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: 0 , ≤ 5.0.7 (semver)

Credits

bnbdr

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:44:31.208878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:44:41.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com/package/brace-expansion",
          "defaultStatus": "unaffected",
          "packageName": "brace-expansion",
          "platforms": [
            "Linux",
            "macOS",
            "Windows"
          ],
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "lessThanOrEqual": "5.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bnbdr"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ebrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The \u003ccode\u003eexpand()\u003c/code\u003e function limits the number of results with a \u003ccode\u003emax\u003c/code\u003e option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (\u003ccode\u003e\u0027{a,b}\u0027.repeat(1500)\u003c/code\u003e) crashes a default Node.js process. Any application that passes attacker-influenced strings to \u003ccode\u003ebrace-expansion.expand()\u003c/code\u003e - directly or transitively via \u003ccode\u003eminimatch\u003c/code\u003e / \u003ccode\u003eglob\u003c/code\u003e brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a \u003ccode\u003emaxLength\u003c/code\u003e option (default 4,000,000) that bounds accumulated output and intermediate arrays.\u003c/p\u003e"
            }
          ],
          "value": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (\u0027{a,b}\u0027.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T12:54:23.124Z",
        "orgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "shortName": "seal"
      },
      "references": [
        {
          "name": "GHSA-mh99-v99m-4gvg",
          "url": "https://www.npmjs.com/package/brace-expansion"
        },
        {
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
    "assignerShortName": "seal",
    "cveId": "CVE-2026-14257",
    "datePublished": "2026-07-23T12:54:23.124Z",
    "dateReserved": "2026-06-30T15:45:06.757Z",
    "dateUpdated": "2026-07-23T14:44:41.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54272 (GCVE-0-2026-54272)

Vulnerability from cvelistv5 – Published: 2026-07-27 17:13 – Updated: 2026-07-27 17:42

Title

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:41 UTC

CWE

CWE-20 - Improper Input Validation
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/beaugunderson/ip-address/secur…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
beaugunderson	ip-address	Affected: >= 10.1.1, < 10.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54272",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:41:46.238340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:42:10.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ip-address",
          "vendor": "beaugunderson",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.1.1, \u003c 10.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 \u2026 labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T17:13:09.244Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg"
        }
      ],
      "source": {
        "advisory": "GHSA-22jq-vg5j-6vgg",
        "discovery": "UNKNOWN"
      },
      "title": "ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54272",
    "datePublished": "2026-07-27T17:13:09.244Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-07-27T17:42:10.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69152 (GCVE-0-2026-69152)

Vulnerability from cvelistv5 – Published: 2026-08-03 16:33 – Updated: 2026-08-03 20:12

Title

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 20:11 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/juliangruber/brace-expansion/s…	x_refsource_CONFIRM
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: < 1.1.18 Affected: >= 2.0.0, < 2.1.4 Affected: >= 3.0.0, < 3.0.6 Affected: >= 4.0.0, < 5.0.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69152",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T20:11:59.381371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T20:12:20.435Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.0.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T16:33:36.324Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        }
      ],
      "source": {
        "advisory": "GHSA-rgw5-rvv9-x895",
        "discovery": "UNKNOWN"
      },
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69152",
    "datePublished": "2026-08-03T16:33:36.324Z",
    "dateReserved": "2026-08-03T15:47:09.654Z",
    "dateUpdated": "2026-08-03T20:12:20.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69192 (GCVE-0-2026-69192)

Vulnerability from cvelistv5 – Published: 2026-08-03 19:56 – Updated: 2026-08-04 13:59

Title

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 13:59 UTC

CWE

CWE-20 - Improper Input Validation
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/beaugunderson/ip-address/secur…	x_refsource_CONFIRM
https://github.com/beaugunderson/ip-address/commi…	x_refsource_MISC
https://github.com/beaugunderson/ip-address/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
beaugunderson	ip-address	Affected: < 10.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69192",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T13:59:11.084723Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T13:59:43.294Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ip-address",
          "vendor": "beaugunderson",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4(\u0027012.0.0.1\u0027) reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch(\u0027http://012.0.0.1/\u0027) connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T19:56:13.640Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        },
        {
          "name": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "name": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mwp4-54f8-5fhr",
        "discovery": "UNKNOWN"
      },
      "title": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69192",
    "datePublished": "2026-08-03T19:56:13.640Z",
    "dateReserved": "2026-08-03T16:00:23.483Z",
    "dateUpdated": "2026-08-04T13:59:43.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:58819

CVE-2026-14257 (GCVE-0-2026-14257)

CVE-2026-54272 (GCVE-0-2026-54272)

CVE-2026-69152 (GCVE-0-2026-69152)

CVE-2026-69192 (GCVE-0-2026-69192)

Tags

Sightings

Nomenclature