CLEANSTART-2026-GE92046 Security fix for CVE-2026-45149 applied in: npm 11.14.0-r0, pulumi 3.248.0-r0, renovate 44.31.0-r1, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

🗓️ 18 Sep 2026 09:57:59Reported by GoogleType

osv🔗 osv.dev👁 4 Views

CVE-2026-45149 security fix in npm, pulumi, and renovate packages.

Reporter	Title	Published	Views	Family All 191
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	18 Sep 202614:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® Big SQL on IBM Software Hub.	7 Aug 202616:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion-5.0.5.tgz which is vulnerable to CVE-2026-45149	30 Jun 202608:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub	13 Jul 202617:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules (CVE-2026-45736, CVE-2026-45149, CVE-2026-3449 & CVE-2026-8723)	29 Jun 202607:47	–	ibm
attackerkb	CVE-2026-45149	29 May 202619:55	–	attackerkb
Atlassian	DoS (Denial of Service) @isaacs/brace-expansion Dependency in Bitbucket Data Center	9 Jun 202610:29	–	atlassian
Atlassian	DoS (Denial of Service) @isaacs/brace-expansion Dependency in Confluence Data Center	8 Jun 202621:29	–	atlassian
Chainguard	CVE-2026-45149 vulnerabilities	20 May 202619:18	–	cgr
Circl	CVE-2026-45149	29 May 202622:33	–	circl

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GE92046.json
osv	www.osv.dev/vulnerability/CVE-2026-45149
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45149

18 Sep 2026 11:46Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.5 - 7.5

EPSS0.003

SSVC

npm pulumi renovate library