redhat/linux-sgx vulnerabilities

Latest redhat/linux-sgx CVEs

Newest publication first · page 1 of 3

1. CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

   Published 2026-10-29

   Medium·CVSS 6.3 EPSS 0.35%

   Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal...

2. CVE-2026-118764 minimatch: potential denial of service via globparts amplification

   Published 2026-10-29

   Medium·CVSS 6.9 EPSS 0.30%

   minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.....

3. CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

   Published 2026-10-27

   Medium·CVSS 6.3 EPSS 0.29%

   Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & (or the configured delimiter), =, or # therefore becomes query string syntax instead of data, so a caller-supplied...

4. CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

   Published 2026-10-20

   Low·CVSS 3.7 EPSS 0.30%

   fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a referenc...

5. CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

   Published 2026-10-20

   Medium·CVSS 6.1 EPSS 0.25%

   fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an inp...

6. CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

   Published 2026-10-20

   Medium·CVSS 4.8 EPSS 0.26%

   fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and...

7. CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization

   Published 2026-10-20

   Low·CVSS 3.7 EPSS 0.29%

   fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, e...

8. CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

   Published 2026-09-28

   High·CVSS 7.5 EPSS 0.49%

   The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the na...

9. CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

   Published 2026-09-28

   Medium·CVSS 5.3 EPSS 0.43%

   The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing c...

10. CVE-2026-102276 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    Published 2026-09-28

    High·CVSS 7.5 EPSS 0.46%

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per br...

11. CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

    Published 2026-09-28

    Medium·CVSS 6.3 EPSS 0.38%

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagn...

12. CVE-2026-93750 http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

    Published 2026-09-18

    High·CVSS 8.2 EPSS 0.45%

    http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cach...

13. CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

    Published 2026-09-18

    High·CVSS 8.7 EPSS 0.60%

    http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s...

14. CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments

    Published 2026-09-18

    High·CVSS 8.7 EPSS 0.45%

    uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/reso...

15. CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

    Published 2026-09-15

    Medium·CVSS 4.8 EPSS 0.25%

    fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is...

16. CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

    Published 2026-09-15

    Medium·CVSS 4.8 EPSS 0.25%

    fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet...

17. CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

    Published 2026-09-15

    Critical·CVSS 9.1 EPSS 0.26%

    proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0...

18. CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

    Published 2026-09-15

    Medium·CVSS 5.9 EPSS 0.52%

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a st...

19. CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

    Published 2026-09-11

    Medium·CVSS 5.3 EPSS 0.41%

    morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker w...

20. CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.38%

    fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() r...

21. CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.24%

    fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting th...

22. CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.54%

    Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (a[]=1,2,3,4) is split into an array without being compared against arrayLimit, while the same value under a flat key (a=1,2,3,4), an indexed key (a[0...

23. CVE-2026-82417 qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

    Published 2026-08-29

    Medium·CVSS 6.3 EPSS 0.40%

    Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBuffer(obj) after checking only that the property is truthy, so a value s...

24. CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

    Published 2026-08-28

    Medium·CVSS 5.3 EPSS 0.40%

    morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unaut...

25. CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

    Published 2026-08-24

    High·CVSS 7.5 EPSS 0.23%

    fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.