redhat/jboss-eap-patch.zip vulnerabilities

Latest redhat/jboss-eap-patch.zip CVEs

Newest publication first

1. CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

   Published 2026-10-29

   Medium·CVSS 6.3 EPSS 0.35%

   Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal...

2. CVE-2026-118764 minimatch: potential denial of service via globparts amplification

   Published 2026-10-29

   Medium·CVSS 6.9 EPSS 0.30%

   minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.....

3. CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

   Published 2026-10-28

   High·CVSS 8.2 EPSS 0.32%

   decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full...

4. CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

   Published 2026-10-27

   Medium·CVSS 6.3 EPSS 0.29%

   Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & (or the configured delimiter), =, or # therefore becomes query string syntax instead of data, so a caller-supplied...

5. CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

   Published 2026-09-28

   High·CVSS 7.5 EPSS 0.49%

   The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the na...

6. CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

   Published 2026-09-28

   Medium·CVSS 5.3 EPSS 0.43%

   The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing c...

7. CVE-2026-102276 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

   Published 2026-09-28

   High·CVSS 7.5 EPSS 0.46%

   The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per br...

8. CVE-2026-93750 http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

   Published 2026-09-18

   High·CVSS 8.2 EPSS 0.45%

   http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cach...

9. CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

   Published 2026-09-18

   High·CVSS 8.7 EPSS 0.60%

   http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s...

10. CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments

    Published 2026-09-18

    High·CVSS 8.7 EPSS 0.45%

    uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/reso...

11. CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

    Published 2026-09-15

    Medium·CVSS 5.9 EPSS 0.52%

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a st...

12. CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

    Published 2026-09-01

    High·CVSS 7.5 EPSS 0.54%

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings...

13. CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.54%

    Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is split into an array without being compared against arrayLimit, while the same value under a flat key (a=1,2,3,4), an indexed key (a[0...

14. CVE-2026-82417 qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.40%

    Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBuffer(obj) after checking only that the property is truthy, so a value s...

15. CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

    Published 2026-08-17

    High·CVSS 7.5 EPSS 0.53%

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and load...

16. CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service

    Published 2026-08-13

    High·CVSS 7.5 EPSS 0.49%

    js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a se...

17. CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

    Published 2026-08-13

    High·CVSS 7.5 EPSS 0.53%

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty membe...

18. CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

    Published 2026-08-11

    High·CVSS 7.5 EPSS 0.66%

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allo...

19. CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

    Published 2026-08-11

    High·CVSS 7.5 EPSS 0.66%

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-sta...

20. CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

    Published 2026-08-04

    High·CVSS 8.7 EPSS 0.46%

    The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength()...

21. CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

    Published 2026-08-04

    Medium·CVSS 6.9 EPSS 0.41%

    The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of a...

22. CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

    Published 2026-08-03

    High·CVSS 7.5 EPSS 0.65%

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled in...

23. CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

    Published 2026-07-23

    High·CVSS 7.5 EPSS 0.64%

    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.