Description
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isaacs | brace-expansion | < 5.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | 2.0.3+~1.1.2-2 | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 25.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.22.2-1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs24 +4 | 1:24.14.1-2.el10_1 | RHSA-2026:7675 |
| RHEL 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | RHSA-2026:7675 |
| RHEL 9 | nodejs +4 | 1:22.22.2-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | npm | 1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7302 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b | RHSA-2026:7350 |
| RHEL 8 | nodejs +4 | 1:22.22.2-1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | npm | 1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.22.2-2.el10_0 | RHSA-2026:7310 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.7-1.22.22.2.2.el10_0 | RHSA-2026:7310 |
| RHEL 9.6 EUS | nodejs +4 | 1:22.22.2-1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.0.1-1.module+el9.6.0+23473+45664c2d | RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:7983 |
| RHEL 9.6 EUS | npm | 1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux 10 | nodejs24-docs | 1:24.14.1-2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 9 | nodejs +4 | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:7350 |
| AlmaLinux 9 | npm | 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 8 | nodejs +4 | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | npm | 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Rocky Linux 10 | nodejs24 | 1:24.14.1-2.el10_1 | RLSA-2026:7675 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:7123 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:7123 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.31.1 | SUSE-SU-2026:1008-1 |
| SLES 15 SP7 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES 15 SP7 | golang-github-prometheus-prometheus | 3.5.0-150100.4.29.1 | SUSE-SU-2026:1008-1 |
| SLES 15 SP7 | golang-github-prometheus-promu | 0.17.0-150000.3.30.1 | SUSE-SU-2026:1013-1 |
| SLES 15 SP6 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES 15 SP5 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES 15 SP4 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21166-1 |
| SLES for SAP 16.0 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21168-1 |
| SLES for SAP 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21167-1 |
| SLES for SAP 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 15 SP6 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES for SAP 15 SP5 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES for SAP 15 SP4 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLES 16.0 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21166-1 |
| SLES 16.0 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21168-1 |
| SLES 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21167-1 |
| SLES 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLE Micro 6.2 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21022-1 |
| SLE Micro 6.2 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21024-1 |
| SLE Micro 6.2 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21023-1 |
| SLE Micro 6.2 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.1 | cockpit | 322-slfo.1.1_3.1 | SUSE-SU-2026:21241-1 |
| SLE Micro 6.1 | cockpit-machines | 316-slfo.1.1_3.1 | SUSE-SU-2026:21253-1 |
| SLE Micro 6.1 | cockpit-podman | 91-slfo.1.1_4.1 | SUSE-SU-2026:21256-1 |
| SLE Micro 6.0 | cockpit-machines | 305-4.1 | SUSE-SU-2026:21246-1 |
| SLE Micro 6.0 | cockpit-tukit | 0.1.2~git0.647b3e3-2.1 | SUSE-SU-2026:21245-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-41.1 | SUSE-SU-2026:21241-1 |
| SLE Micro 5.5 | cockpit | 298-150500.3.12.1 | SUSE-SU-2026:2363-1 |
| SLE Micro 5.2 | cockpit | 251.3-150300.6.9.1 | SUSE-SU-2026:1232-1 |
| SLE Micro 5.2 | cockpit-machines | 249.1-150300.5.6.1 | SUSE-SU-2026:1249-1 |
| SLE Micro 5.2 | cockpit-podman | 33-150300.6.9.1 | SUSE-SU-2026:1251-1 |
| SLE Micro 5.2 | cockpit-tukit | 0.0.3~git14.ff11a9a-150300.1.9.1 | SUSE-SU-2026:1250-1 |
| SLE HPC 15 SP5 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SLE HPC 15 SP4 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.0-150002.3.8.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security01-150002.4.14.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.1.13-150002.3.9.3 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | Multi-Linux-ManagerTools-Beta-SLE-Micro-release | 5-159000.3.3.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | dracut-saltboot | 1.1.0-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | dracut-wireless | 0.1.1595937550.0285244-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | golang-github-prometheus-node_exporter | 1.9.1-159000.4.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | uyuni-tools | 5.2.5-159000.2.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-Micro-5 | venv-salt-minion | 3006.0-159000.5.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | dracut-saltboot | 1.1.0-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | dracut-wireless | 0.1.1595937550.0285244-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-boynux-squid_exporter | 1.13.0-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-159000.12.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-prometheus-node_exporter | 1.9.1-159000.4.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | golang-github-prometheus-prometheus | 3.5.0-159000.4.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | grafana | 11.6.11-159000.2.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | mgr-push +1 | 5.2.3-159000.2.3.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | prometheus-blackbox_exporter | 0.26.0-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | prometheus-postgres_exporter | 0.10.1-159000.2.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | python-defusedxml | 0.7.1-159000.4.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | rhnlib +1 | 5.2.4-159000.4.3.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | spacecmd | 5.2.6-159000.4.3.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | supportutils-plugin-salt | 1.2.3-159000.4.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | supportutils-plugin-susemanager-client | 5.2.2-159000.4.2.1 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | uyuni-tools | 5.2.5-159000.2.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Multi Linux Manager Tools Beta SLE-15 | venv-salt-minion | 3006.0-159000.5.3.2 | SUSE-SU-2026:1148-1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 1.1.0-150000.1.65.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools for SLE Micro 5 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-tools | 0.1.38-150000.1.30.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 1.1.0-150000.1.65.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | golang-github-boynux-squid_exporter | 1.13.0-150000.1.12.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150000.1.26.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.31.1 | SUSE-SU-2026:1008-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.0-150000.3.67.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | grafana | 11.6.11-150000.1.90.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | spacecmd | 5.0.15-150000.3.142.1 | SUSE-SU-2026:1013-1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.38-150000.1.30.1 | SUSE-SU-2026:1013-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cockpit | 356-2.1 | openSUSE-SU-2026:10268-1 |
| openSUSE Tumbleweed | cockpit-machines | 348-1.1 | openSUSE-SU-2026:10250-1 |
| openSUSE Tumbleweed | cockpit-packages | 4.1-4.1 | openSUSE-SU-2026:10251-1 |
| openSUSE Tumbleweed | cockpit-podman | 120-2.1 | openSUSE-SU-2026:10269-1 |
| openSUSE Tumbleweed | cockpit-repos | 4.7-4.1 | openSUSE-SU-2026:10252-1 |
| openSUSE Tumbleweed | cockpit-subscriptions | 14.4-4.1 | openSUSE-SU-2026:10253-1 |
| openSUSE Tumbleweed | cockpit-tukit | 0.1.7~git0.61e54f1-3.1 | openSUSE-SU-2026:10254-1 |
| openSUSE Tumbleweed | heroic-games-launcher | 2.20.0-1.1 | openSUSE-SU-2026:10236-1 |
| openSUSE Tumbleweed | openQA | 5.1770718745.ce2072d3-1.1 | openSUSE-SU-2026:10168-1 |
| openSUSE Tumbleweed | python-bqplot | 0.12.45-14.1 | openSUSE-SU-2026:10424-1 |
| openSUSE Tumbleweed | python-jupyter-ydoc | 3.4.0-2.1 | openSUSE-SU-2026:10428-1 |
| openSUSE Leap 16.0 | cockpit | 354-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20504-1 |
| openSUSE Leap 16.0 | cockpit-machines | 346-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20503-1 |
| openSUSE Leap 16.0 | cockpit-packages | 5-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-podman | 117-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20502-1 |
| openSUSE Leap 16.0 | cockpit-repos | 4.8-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | golang-github-prometheus-prometheus | 3.5.0-160000.2.1 | openSUSE-SU-2026:20239-1 |
| openSUSE Leap 16.0 | openQA | 5.1771422749.560a3b26-bp160.1.1 | openSUSE-SU-2026:20261-1 |
| openSUSE Leap 16.0 | os-autoinst | 5.1771353921.c8005c9-bp160.1.1 | openSUSE-SU-2026:20261-1 |
| openSUSE Leap 15.6 | dracut-saltboot | 1.1.0-150000.1.65.1 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | golang-github-boynux-squid_exporter | 1.13.0-150000.1.12.1 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | golang-github-lusitaniae-apache_exporter | 1.0.10-150000.1.26.1 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.31.1 | SUSE-SU-2026:1008-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-node_exporter | 1.9.1-150100.3.38.1 | SUSE-SU-2026:1008-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-prometheus | 3.5.0-150100.4.29.1 | SUSE-SU-2026:1008-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-promu | 0.17.0-150000.3.30.1 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 | SUSE-SU-2026:1013-1 |
| openSUSE Leap 15.6 | spacecmd | 5.0.15-150000.3.142.1 | SUSE-SU-2026:1013-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.22.2-1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.7-1.22.22.2.1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.15.0-1.amzn2023.0.1 | ALAS2023-2026-1609 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.12.1-1.24.15.0.1.amzn2023.0.1 | ALAS2023-2026-1609 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.amzn2023.0.3 | ALAS2023-2026-1648 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.15.0.1.amzn2023.0.1 | ALAS2023-2026-1609 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.22.2-1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.14.1-2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 9 | nodejs +4 | 1:22.22.2-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+90866+5a953a4c | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | npm | 1:10.9.7-1.22.22.2.1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7302 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+90866+5a953a4c | ELSA-2026-7350 |
| Oracle Linux 8 | nodejs +4 | 1:22.22.2-1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | npm | 1:10.9.7-1.22.22.2.1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | lerna | 9.0.3-r3 | — |
| Wolfi rolling | node-gyp | 12.2.0-r2 | — |
| Wolfi rolling | npm | 11.9.0-r0 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.217.1-r2 | — |
| Wolfi rolling | renovate | 43.2.4-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @isaacs/brace-expansion | < 5.0.1 | 5.0.1 | GHSA-7h2j-956f-4vf2 |
Advisories 50
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:7350 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7675 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7080 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7123 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:7983 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7675 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7350 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7302 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7310 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7123 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7080 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-1229 Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
- SUSE-SU-2026:22837-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22770-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:2363-1 Security update for cockpit SUSE / openSUSE Security Updates · Jun 12, 2026
- ELSA-2026-7675 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 9, 2026
- ALAS2023-2026-1648 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- WID-SEC-2026-0526 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- ALAS2023-2026-1609 Moderate: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- SUSE-SU-2026:21246-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21245-1 Security update for cockpit-tukit SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21253-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21241-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21256-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 24, 2026
- openSUSE-SU-2026:20504-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20502-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21168-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21167-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21166-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20503-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:1524-1 Security update 5.1.3 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Apr 22, 2026
- RLSA-2026:7675 Important: nodejs24 security update Rocky Linux Security Advisories · Apr 15, 2026
- SUSE-SU-2026:21022-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 14, 2026
- SUSE-SU-2026:21023-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 14, 2026
- SUSE-SU-2026:21024-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 14, 2026
- RLSA-2026:7080 Important: nodejs22 security update Rocky Linux Security Advisories · Apr 12, 2026
- SUSE-SU-2026:1251-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 11, 2026
- SUSE-SU-2026:1250-1 Security update for cockpit-tukit SUSE / openSUSE Security Updates · Apr 11, 2026
- SUSE-SU-2026:1249-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 11, 2026
- SUSE-SU-2026:1232-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 10, 2026
- RLSA-2026:7350 Important: nodejs:24 security update Rocky Linux Security Advisories · Apr 10, 2026
- ELSA-2026-7302 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
- ELSA-2026-7350 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
- RLSA-2026:7302 Important: nodejs:22 security update Rocky Linux Security Advisories · Apr 9, 2026
- RLSA-2026:7123 Important: nodejs:22 security update Rocky Linux Security Advisories · Apr 9, 2026
- ELSA-2026-7123 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 9, 2026
- ELSA-2026-7080 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 8, 2026
- SUSE-SU-2026:1148-1 Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Mar 31, 2026