Поиск уязвимостей
Количество 11
Количество 11
GHSA-q2hr-2g5m-vwhr
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a c ...
openSUSE-SU-2026:22111-1
Security update for pi-coding-agent
RLSA-2026:92378
Important: nodejs:24 security, bug fix, and enhancement update
RLSA-2026:92376
Important: nodejs:24 security, bug fix, and enhancement update
ELSA-2026-92378
ELSA-2026-92378: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-92376
ELSA-2026-92376: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
| CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a c ... | CVSS3: 5.3 | 0% Низкий | около 1 месяца назад |
 | openSUSE-SU-2026:22111-1 Security update for pi-coding-agent | около 1 месяца назад | ||
 | RLSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update | 10 дней назад | ||
| RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update | 11 дней назад | ||
| ELSA-2026-92378 ELSA-2026-92378: nodejs:24 security, bug fix, and enhancement update (IMPORTANT) | 11 дней назад | ||
| ELSA-2026-92376 ELSA-2026-92376: nodejs:24 security, bug fix, and enhancement update (IMPORTANT) | 11 дней назад |
Уязвимостей на страницу