@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +317 more potentially affected by CVE-2026-27904 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

10up-toolkit (>=6.0.0-next.0, <=6.5.1), @0ti.me/ts-test-deps (0.2.0) +6563 more potentially affected by CVE-2026-27904 via minimatch (>=9.0.0, <=9.0.6)

minimatch NPM version =9.0.0, =6.0.0-next.0, =1.1.0-pre.1, =1.4.0, =9.1.0, =1.17.3-testing-284.48.0, =1.0.0, =1.1.6, =0.0.0-alpha.1011313d2aaf, =1.1.3, =1.0.6, =1.0.25 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +898 more potentially affected by CVE-2026-27904 via minimatch (>=5.0.0, <=5.1.7)

minimatch NPM version =5.0.0, =1.0.7, =10.4.0, =9.0.0, =10.0.0, =10.0.0, =10.5.0, =10.4.0, =0.4.13, =2.3.0, =2.3.0, =2.2.1, =2.2.1, =2.2.2 - @aid-on/aidify 0.1.2 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27904 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27904...

GHSA-23C5-XMQV-RM74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Summary Nested extglobs produce regexps with nested unbounded quantifiers e.g. ?:?:a|b, which exhibit catastrophic backtracking in V8. With a 12-byte pattern a|b and an 18-byte non-matching input, minimatch stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes...

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Summary Nested extglobs produce regexps with nested unbounded quantifiers e.g. ?:?:a|b, which exhibit catastrophic backtracking in V8. With a 12-byte pattern a|b and an 18-byte non-matching input, minimatch stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes...

CVE-2026-26936 Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service

Inefficient Regular Expression Complexity CWE-1333 in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup CAPEC-492...

Kibana 8.19.11, 9.2.5 Security Update (ESA-2026-14)

Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service Inefficient Regular Expression Complexity CWE-1333 in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup CAPEC-492. Affected Versions: 8.x: All versio...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +317 more potentially affected by CVE-2026-27903 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

10up-toolkit (>=6.0.0-next.0, <=6.5.1), @0ti.me/ts-test-deps (0.2.0) +6563 more potentially affected by CVE-2026-27903 via minimatch (>=9.0.0, <=9.0.6)

minimatch NPM version =9.0.0, =6.0.0-next.0, =1.1.0-pre.1, =1.4.0, =9.1.0, =1.17.3-testing-284.48.0, =1.0.0, =1.1.6, =0.0.0-alpha.1011313d2aaf, =1.1.3, =1.0.6, =1.0.25 and more Source cves: CVE-2026-27903 Source advisory: SNYK:JS-MINIMATCH-15353389...

02strich-markdown (>=1.0.0, <=1.0.2), @0xintuition/slang-cli (>=0.0.1-b, <=0.0.8) +1945 more potentially affected by CVE-2026-27903 via minimatch (>=4.1.1, <=4.2.4)

minimatch NPM version =4.1.1, =1.0.0, =0.0.1-b, =0.5.2, =5.0.2, =2.2.0, =1.1.4, =1.3.1, =1.0.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =1.1.8, =1.0.0, =1.5.0 and more Source cves: CVE-2026-27903 Source advisory:...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27904 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27904...

📄 fast-xml-parser REGEX Injection / Cross Site Scripting

fast-xml-parser versions starting at 4.1.3 and below 5.3.5 suffer from a REGEX injection issue that can allow for cross site scripting attacks. ============================================================================================================================================= | Title :...

CVE-2026-1388

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint und...

CVE-2026-1388

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint und...

CVE-2026-1388

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint und...

CVE-2026-1388

Removed by vendor...

CVE-2026-1388 Inefficient Regular Expression Complexity in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint und...

Regular Expression Denial Of Service (ReDoS)

@fedify/fedify is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to nested quantifiers in the HTML parsing regex within the document loader, which allows an attacker to trigger catastrophic backtracking by sending specially crafted HTML responses...

PT-2026-21994

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.2 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 GitLab CE/EE versions 18.9 through 18.9.0 Description An unauthenticated user could potentially cause a denial of service by sending specially crafted input to ...