0 releases 22 tags

RSS feed

• imports/c10s/nodejs24-24.18.0-3.el10 b152955871

  Compare

  Fix CVE-2026-13149 (brace-expansion)

  Ghost released this 2026-08-03 11:15:05 +00:00 | 4 commits to c10s since this release

  Backport upstream fix for CVE-2026-13149, a ReDoS/exponential
  blowup vulnerability in the bundled brace-expansion dependency.

  The fix updates brace-expansion from 5.0.6 to 5.0.7 by patching
  the compiled JS files (commonjs and esm) under
  deps/npm/node_modules/brace-expansion/. The core change defers
  expansion of post until after early returns and replaces a
  recursive call with a loop in expand_(), preventing O(2^n)
  blowup on inputs like a{},{},{},{}... and avoiding stack
  exhaustion from long runs of non-expanding {} groups.

  CVE: CVE-2026-13149
  Advisories:

  • github.com/juliangruber/brace-expansion@c7e33ec13a
    Upstream patches:
  • github.com/juliangruber/brace-expansion@c7e33ec13a.patch

  Resolves: RHEL-208655
  This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

  Assisted-by: Ymir

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads