ROOT-APP-NPM-CVE-2026-25547 CVE-2026-25547 in @rootio/isaacs__brace-expansion - Patched by Root

Root has patched CVE-2026-25547 in the @rootio/isaacsbrace-expansion package for Root:npm. Multiple fixed versions available...

RHEL 9 : nodejs:22 (RHSA-2026:7983)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7983 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

nodejs22 security update

An update is available for nodejs22. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime \ for easily...

Security update for cockpit-tukit

This update for cockpit-tukit fixes the following issues: CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process bsc1257836. CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive...

Important: Red Hat Security Advisory: nodejs:24 security update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs22 security update

1:22.22.2-1 - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 1:22.22.0-4 - sources: changed ICU version syntax...

Security Bulletin: Multiple vulnerabilities in IBM Event Endpoint Management.

Summary Multiple vulnerabilities were addressed in IBM Event Endpoint Management 11.7.3 Vulnerability Details CVEID:CVE-2025-68470 DESCRIPTION: React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a Rea...

openSUSE Security Advisory (SUSE-SU-2026:1008-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: firewalld-prometheus-config / golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:1008-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1008-1 advisory. golang-github-prometheus-alertmanager, golang-github-prometheus-nodeexporter: - Internal changes...

cockpit-repos-4.7-4.1 on GA media (moderate)

cockpit-repos-4.7-4.1 on GA media Announcement ID: openSUSE-SU-2026:10252-1 Rating: moderate Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25547 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA...

cockpit-subscriptions-14.4-4.1 on GA media (moderate)

cockpit-subscriptions-14.4-4.1 on GA media Announcement ID: openSUSE-SU-2026:10253-1 Rating: moderate Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25547 SUSE : 8.7...

cockpit-packages-4.1-4.1 on GA media (moderate)

cockpit-packages-4.1-4.1 on GA media Announcement ID: openSUSE-SU-2026:10251-1 Rating: moderate Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25547 SUSE : 8.7...

cockpit-machines-348-1.1 on GA media (moderate)

cockpit-machines-348-1.1 on GA media Announcement ID: openSUSE-SU-2026:10250-1 Rating: moderate Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25547 SUSE : 8.7...

Security update for openQA, openQA-devel-container, os-autoinst (moderate)

openSUSE Security Update: Security update for openQA, openQA-devel-container, os-autoinst Announcement ID: openSUSE-SU-2026:0060-1 Rating: moderate References: 1257852 Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected...

Security update for openQA, os-autoinst, openQA-devel-container (important)

openSUSE security update: security update for openqa, os-autoinst, openqa-devel-container ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20261-1 Rating: important References: bsc1257852 Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547...

CVE-2026-25547 vulnerabilities

Vulnerabilities for packages: lerna, pulumi, renovate, sqlpad, npm, node-gyp...

CVE-2026-25547

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, t...