0 releases 27 tags

RSS feed

• imports/c10s/nodejs22-22.23.1-4.el10 265841473c

  Compare

  Fix CVE-2026-13149 (npm/brace-expansion)

  Ghost released this 2026-08-03 14:10:42 +00:00 | 4 commits to c10s since this release

  Backport fix for CVE-2026-13149, an unbound recursion
  vulnerability in the brace-expansion module vendored by npm.

  The upstream TypeScript fix was manually adapted to the
  JavaScript version (brace-expansion 2.0.2) shipped in
  Node.js 22. Key changes: wrap expand() body in a for-loop
  to avoid recursive stack exhaustion on non-expanding {}
  groups, defer post-expansion until a brace set is confirmed
  to expand (preventing O(2^n) blowup), and compute post
  inline for the $ prefix case.

  CVE: CVE-2026-13149
  Upstream patches:

  • github.com/juliangruber/brace-expansion@c7e33ec13a.patch
    Resolves: RHEL-208653

  This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

  Assisted-by: Ymir

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads