[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-16729":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":385,"aliases":386,"duplicate_of":9,"upstream":469,"downstream":470,"duplicates":483,"related":484,"reserved_at":9,"published_at":491,"modified_at":492,"state":493,"summary":494,"references_raw":503,"kevs":571,"epss":572,"epss_history":575,"metrics":723,"affected":744},"CVE-2026-16729","undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-74","Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","weakness","Incomplete","Class","High",[20,24,28,32,36,40,224,228,232,236,240,281,285,289,293,297,301,305,309,313,317,321,325,329,333,337,341,345,349,353,357,361,365,369,373,377,381],{"id":21,"name":22,"techniques":23},"CAPEC-10","Buffer Overflow via Environment Variables",[],{"id":25,"name":26,"techniques":27},"CAPEC-101","Server Side Include (SSI) Injection",[],{"id":29,"name":30,"techniques":31},"CAPEC-105","HTTP Request Splitting",[],{"id":33,"name":34,"techniques":35},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":37,"name":38,"techniques":39},"CAPEC-120","Double Encoding",[],{"id":41,"name":42,"techniques":43},"CAPEC-13","Subverting Environment Variable Values",[44,142,184],{"id":45,"name":46,"tactics":47,"countermeasures":54},"T1562.003","Impair Command History Logging",[48,51],{"id":49,"name":50},"TA0030","Defense Evasion",{"id":52,"name":53},"TA0005","Stealth",[55,60,65,70,75,80,85,89,93,97,101,106,110,114,118,122,126,130,134,138],{"id":56,"name":57,"tactic":58},"D3-RF","Restore File",{"name":59},"Restore",{"id":61,"name":62,"tactic":63},"D3-CQ","Content Quarantine",{"name":64},"Isolate",{"id":66,"name":67,"tactic":68},"D3-CI","Configuration Inventory",{"name":69},"Model",{"id":71,"name":72,"tactic":73},"D3-DF","Decoy File",{"name":74},"Deceive",{"id":76,"name":77,"tactic":78},"D3-FA","File Analysis",{"name":79},"Detect",{"id":81,"name":82,"tactic":83},"D3-DRA","Disable Remote Access",{"name":84},"Harden",{"id":86,"name":87,"tactic":88},"D3-ACH","Application Configuration Hardening",{"name":84},{"id":90,"name":91,"tactic":92},"D3-RC","Restore Configuration",{"name":59},{"id":94,"name":95,"tactic":96},"D3-FE","File Encryption",{"name":84},{"id":98,"name":99,"tactic":100},"D3-FIM","File Integrity Monitoring",{"name":79},{"id":102,"name":103,"tactic":104},"D3-RKD","Registry Key Deletion",{"name":105},"Evict",{"id":107,"name":108,"tactic":109},"D3-DA","Dynamic Analysis",{"name":79},{"id":111,"name":112,"tactic":113},"D3-CF","Content Filtering",{"name":64},{"id":115,"name":116,"tactic":117},"D3-LFP","Local File Permissions",{"name":64},{"id":119,"name":120,"tactic":121},"D3-FEV","File Eviction",{"name":105},{"id":123,"name":124,"tactic":125},"D3-EFA","Emulated File Analysis",{"name":79},{"id":127,"name":128,"tactic":129},"D3-RFAM","Remote File Access Mediation",{"name":64},{"id":131,"name":132,"tactic":133},"D3-CM","Content Modification",{"name":64},{"id":135,"name":136,"tactic":137},"D3-EAL","Executable Allowlisting",{"name":64},{"id":139,"name":140,"tactic":141},"D3-EDL","Executable Denylisting",{"name":64},{"id":143,"name":144,"tactics":145,"countermeasures":157},"T1574.006","Dynamic Linker Hijacking",[146,149,152,153,154],{"id":147,"name":148},"TA0110","Persistence",{"id":150,"name":151},"TA0111","Privilege Escalation",{"id":49,"name":50},{"id":52,"name":53},{"id":155,"name":156},"TA0104","Execution",[158,160,162,164,168,170,172,174,176,178,180,182],{"id":131,"name":132,"tactic":159},{"name":64},{"id":119,"name":120,"tactic":161},{"name":105},{"id":76,"name":77,"tactic":163},{"name":79},{"id":165,"name":166,"tactic":167},"D3-SFA","System File Analysis",{"name":79},{"id":56,"name":57,"tactic":169},{"name":59},{"id":111,"name":112,"tactic":171},{"name":64},{"id":115,"name":116,"tactic":173},{"name":64},{"id":94,"name":95,"tactic":175},{"name":84},{"id":127,"name":128,"tactic":177},{"name":64},{"id":61,"name":62,"tactic":179},{"name":64},{"id":71,"name":72,"tactic":181},{"name":74},{"id":98,"name":99,"tactic":183},{"name":79},{"id":185,"name":186,"tactics":187,"countermeasures":193},"T1574.007","Path Interception by PATH Environment Variable",[188,189,190,191,192],{"id":147,"name":148},{"id":150,"name":151},{"id":49,"name":50},{"id":52,"name":53},{"id":155,"name":156},[194,196,198,200,202,204,206,208,210,212,214,216,218,220,222],{"id":131,"name":132,"tactic":195},{"name":64},{"id":76,"name":77,"tactic":197},{"name":79},{"id":71,"name":72,"tactic":199},{"name":74},{"id":111,"name":112,"tactic":201},{"name":64},{"id":119,"name":120,"tactic":203},{"name":105},{"id":98,"name":99,"tactic":205},{"name":79},{"id":115,"name":116,"tactic":207},{"name":64},{"id":94,"name":95,"tactic":209},{"name":84},{"id":135,"name":136,"tactic":211},{"name":64},{"id":107,"name":108,"tactic":213},{"name":79},{"id":127,"name":128,"tactic":215},{"name":64},{"id":139,"name":140,"tactic":217},{"name":64},{"id":123,"name":124,"tactic":219},{"name":79},{"id":61,"name":62,"tactic":221},{"name":64},{"id":56,"name":57,"tactic":223},{"name":59},{"id":225,"name":226,"techniques":227},"CAPEC-135","Format String Injection",[],{"id":229,"name":230,"techniques":231},"CAPEC-14","Client-side Injection-induced Buffer Overflow",[],{"id":233,"name":234,"techniques":235},"CAPEC-24","Filter Failure through Buffer Overflow",[],{"id":237,"name":238,"techniques":239},"CAPEC-250","XML Injection",[],{"id":241,"name":242,"techniques":243},"CAPEC-267","Leverage Alternate Encoding",[244],{"id":245,"name":246,"tactics":247,"countermeasures":250},"T1027","Obfuscated Files or Information",[248,249],{"id":49,"name":50},{"id":52,"name":53},[251,253,255,257,259,261,263,265,267,269,271,273,275,277,279],{"id":98,"name":99,"tactic":252},{"name":79},{"id":71,"name":72,"tactic":254},{"name":74},{"id":135,"name":136,"tactic":256},{"name":64},{"id":139,"name":140,"tactic":258},{"name":64},{"id":115,"name":116,"tactic":260},{"name":64},{"id":56,"name":57,"tactic":262},{"name":59},{"id":119,"name":120,"tactic":264},{"name":105},{"id":107,"name":108,"tactic":266},{"name":79},{"id":127,"name":128,"tactic":268},{"name":64},{"id":94,"name":95,"tactic":270},{"name":84},{"id":76,"name":77,"tactic":272},{"name":79},{"id":131,"name":132,"tactic":274},{"name":64},{"id":111,"name":112,"tactic":276},{"name":64},{"id":61,"name":62,"tactic":278},{"name":64},{"id":123,"name":124,"tactic":280},{"name":79},{"id":282,"name":283,"techniques":284},"CAPEC-273","HTTP Response Smuggling",[],{"id":286,"name":287,"techniques":288},"CAPEC-28","Fuzzing",[],{"id":290,"name":291,"techniques":292},"CAPEC-3","Using Leading 'Ghost' Character Sequences to Bypass Input Filters",[],{"id":294,"name":295,"techniques":296},"CAPEC-34","HTTP Response Splitting",[],{"id":298,"name":299,"techniques":300},"CAPEC-42","MIME Conversion",[],{"id":302,"name":303,"techniques":304},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":306,"name":307,"techniques":308},"CAPEC-45","Buffer Overflow via Symbolic Links",[],{"id":310,"name":311,"techniques":312},"CAPEC-46","Overflow Variables and Tags",[],{"id":314,"name":315,"techniques":316},"CAPEC-47","Buffer Overflow via Parameter Expansion",[],{"id":318,"name":319,"techniques":320},"CAPEC-51","Poison Web Service Registry",[],{"id":322,"name":323,"techniques":324},"CAPEC-52","Embedding NULL Bytes",[],{"id":326,"name":327,"techniques":328},"CAPEC-53","Postfix, Null Terminate, and Backslash",[],{"id":330,"name":331,"techniques":332},"CAPEC-6","Argument Injection",[],{"id":334,"name":335,"techniques":336},"CAPEC-64","Using Slashes and URL Encoding Combined to Bypass Validation Logic",[],{"id":338,"name":339,"techniques":340},"CAPEC-67","String Format Overflow in syslog()",[],{"id":342,"name":343,"techniques":344},"CAPEC-7","Blind SQL Injection",[],{"id":346,"name":347,"techniques":348},"CAPEC-71","Using Unicode Encoding to Bypass Validation Logic",[],{"id":350,"name":351,"techniques":352},"CAPEC-72","URL Encoding",[],{"id":354,"name":355,"techniques":356},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":358,"name":359,"techniques":360},"CAPEC-78","Using Escaped Slashes in Alternate Encoding",[],{"id":362,"name":363,"techniques":364},"CAPEC-79","Using Slashes in Alternate Encoding",[],{"id":366,"name":367,"techniques":368},"CAPEC-8","Buffer Overflow in an API Call",[],{"id":370,"name":371,"techniques":372},"CAPEC-80","Using UTF-8 Encoding to Bypass Validation Logic",[],{"id":374,"name":375,"techniques":376},"CAPEC-83","XPath Injection",[],{"id":378,"name":379,"techniques":380},"CAPEC-84","XQuery Injection",[],{"id":382,"name":383,"techniques":384},"CAPEC-9","Buffer Overflow in Local Command-Line Utilities",[],[],[387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468],"UBUNTU-CVE-2026-16729","DEBIAN-CVE-2026-16729","GHSA-v3r7-h72x-cjcm","CGA-3p6x-cm8q-v8c3","CGA-5qjm-r8wp-cj34","CGA-5w57-fr4h-fc39","CGA-68qm-4w4p-q6jj","CGA-6jg5-q4rg-cgh9","CGA-cjmr-28q2-qr9p","CGA-fpxm-w9f4-7g39","CGA-ggcg-gv62-wpcf","CGA-gvwq-4r2m-fq3g","CGA-h2xc-29f8-wv8x","CGA-h5rm-p2xq-c6p2","CGA-hxmv-xwpr-66qj","CGA-mv4x-r95w-h8gm","CGA-p2g7-w8gh-rc98","CGA-pf47-4jgv-4jmx","CGA-pv97-9gf7-cxxv","CGA-pwj6-5rxm-q53v","CGA-2grq-9mw4-874f","CGA-2vq7-w2jq-cf6x","CGA-38jg-m8hm-xrvq","CGA-3c5v-ggg3-r7fj","CGA-46qw-hx9f-87f7","CGA-4pww-rppx-53q4","CGA-4q22-q77m-mrpx","CGA-4rf5-ff22-cjqw","CGA-55qj-6g7w-vv32","CGA-63fc-rm78-fph5","CGA-64gq-8q68-xjc4","CGA-6fx6-9x2x-jxw7","CGA-6v72-qc9m-f666","CGA-743j-7f7p-5rwj","CGA-7c73-6p2f-wjjv","CGA-893w-83jm-9x74","CGA-8cq8-47p4-cx64","CGA-8vcm-9g87-mxrg","CGA-98gp-c6hp-9c5x","CGA-c74c-64hr-7733","CGA-cf6j-pvcc-4w97","CGA-cj84-25p6-j5q7","CGA-f2hq-j4jj-j9v5","CGA-fvc8-7wv3-xqh7","CGA-fw78-c4pr-xchh","CGA-fx3w-jm7j-q6x3","CGA-g7q6-wpc9-xmqj","CGA-h7rr-4wvr-8q9p","CGA-hxp9-m2c2-fh3v","CGA-j2w4-j8jx-jm2x","CGA-jj46-wpj9-wcf7","CGA-mmqq-8743-j7vc","CGA-pv49-679c-q29m","CGA-qvm2-8fjp-j276","CGA-r2r6-jvc8-xc46","CGA-r3wp-frv5-w6qv","CGA-v7f7-9689-h7mf","CGA-v7fc-78qm-pfc8","CGA-vhpx-x94f-9v9g","CGA-vx9j-phcr-4pwm","CGA-w3jf-fc97-9wrj","CGA-w9xp-49mm-x2ph","CGA-wf85-vxmq-5c9m","CGA-whfq-q2w3-5f49","CGA-wwp6-g9m9-hcxr","CGA-x586-m7gj-h489","CGA-x8h3-c59x-hgfx","CGA-xcp5-mr9h-c9rj","CGA-xph7-crcg-65fp","CGA-3fg7-xppm-g8pp","CGA-jhgx-pffj-3vg6","CGA-rf5w-c6cq-rjv6","CGA-xrr4-m582-vjxg","CGA-59qp-g2jj-989h","CGA-gfc7-g8hf-chjg","CGA-vpw7-2jjv-99mh","CGA-7xm8-q629-xhjf","CGA-8rv7-vjgj-89jr","CGA-hw4h-g9h7-hp54","CGA-rw79-5mxp-ph77","CGA-2p5g-9xg3-f55x","CGA-x974-32hm-454p",[],[471,473,475,477,479,481],{"_key":472},"RHSA-2026:48273",{"_key":474},"RHSA-2026:48537",{"_key":476},"SUSE-SU-2026:3929-1",{"_key":478},"SUSE-SU-2026:3930-1",{"_key":480},"SUSE-SU-2026:4248-1",{"_key":482},"SUSE-SU-2026:4261-1",[],[485,486,487,488,489],{"_key":476},{"_key":478},{"_key":480},{"_key":482},{"_key":490},"CGA-9JF5-QMM3-5C74","2026-07-29T16:45:57.001Z","2026-07-29T18:08:16.149Z","Analyzed",{"cisa_kev":495,"cisa_ransomware":495,"cisa_vendor":9,"epss_severity":496,"epss_score":497,"severity":498,"severity_score":499,"severity_version":500,"severity_source":501,"severity_vector":502,"severity_status":493},false,"low",0.00191,"medium",6.5,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",[504,517,521,525,529,534,538,542,546,550,555,559,563,567],{"url":505,"sources":506,"tags":512},"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm",[507,501,508,509,510,511],"cve.org","osv_ubuntu","osv_npm","osv_wolfi","osv_chainguard",[513,514,515,516],"Vendor Advisory","REPORT","WEB","Advisory",{"url":518,"sources":519,"tags":520},"https://cna.openjsf.org/security-advisories.html",[507,501,509,510,511],[513,515,516],{"url":522,"sources":523,"tags":524},"https://ubuntu.com/security/CVE-2026-16729",[508],[514],{"url":526,"sources":527,"tags":528},"https://www.cve.org/CVERecord?id=CVE-2026-16729",[508],[514],{"url":530,"sources":531,"tags":533},"https://security-tracker.debian.org/tracker/CVE-2026-16729",[532],"osv_debian",[516],{"url":535,"sources":536,"tags":537},"https://nvd.nist.gov/vuln/detail/CVE-2026-16729",[509,510,511],[516],{"url":539,"sources":540,"tags":541},"https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5",[509],[515],{"url":543,"sources":544,"tags":545},"https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef",[509],[515],{"url":547,"sources":548,"tags":549},"https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235",[509],[515],{"url":551,"sources":552,"tags":553},"https://github.com/nodejs/undici",[509],[554],"PACKAGE",{"url":556,"sources":557,"tags":558},"https://github.com/nodejs/undici/releases/tag/v6.28.0",[509],[515],{"url":560,"sources":561,"tags":562},"https://github.com/nodejs/undici/releases/tag/v7.29.0",[509],[515],{"url":564,"sources":565,"tags":566},"https://github.com/nodejs/undici/releases/tag/v8.9.0",[509],[515],{"url":568,"sources":569,"tags":570},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16729.json",[510,511],[516],[],{"date":573,"score":497,"percentile":574},"2026-09-19",0.09016,[576,580,583,586,589,592,595,598,602,605,608,611,613,616,619,621,624,627,630,633,635,638,641,644,646,649,652,655,658,660,663,666,669,672,675,677,679,681,684,687,690,692,695,698,701,704,707,710,713,716,719,722],{"date":577,"score":578,"percentile":579},"2026-07-30",0.00176,0.07428,{"date":581,"score":578,"percentile":582},"2026-07-31",0.07429,{"date":584,"score":578,"percentile":585},"2026-08-01",0.07414,{"date":587,"score":578,"percentile":588},"2026-08-02",0.0739,{"date":590,"score":578,"percentile":591},"2026-08-03",0.07384,{"date":593,"score":578,"percentile":594},"2026-08-04",0.0737,{"date":596,"score":578,"percentile":597},"2026-08-05",0.07351,{"date":599,"score":600,"percentile":601},"2026-08-06",0.00167,0.06291,{"date":603,"score":600,"percentile":604},"2026-08-07",0.06292,{"date":606,"score":600,"percentile":607},"2026-08-08",0.06295,{"date":609,"score":600,"percentile":610},"2026-08-09",0.0629,{"date":612,"score":600,"percentile":607},"2026-08-10",{"date":614,"score":600,"percentile":615},"2026-08-11",0.06303,{"date":617,"score":600,"percentile":618},"2026-08-12",0.06321,{"date":620,"score":600,"percentile":618},"2026-08-13",{"date":622,"score":600,"percentile":623},"2026-08-14",0.06347,{"date":625,"score":600,"percentile":626},"2026-08-15",0.06353,{"date":628,"score":600,"percentile":629},"2026-08-16",0.06358,{"date":631,"score":600,"percentile":632},"2026-08-17",0.06384,{"date":634,"score":600,"percentile":632},"2026-08-18",{"date":636,"score":600,"percentile":637},"2026-08-19",0.06415,{"date":639,"score":600,"percentile":640},"2026-08-20",0.0642,{"date":642,"score":600,"percentile":643},"2026-08-21",0.06412,{"date":645,"score":600,"percentile":643},"2026-08-22",{"date":647,"score":600,"percentile":648},"2026-08-23",0.06383,{"date":650,"score":497,"percentile":651},"2026-08-24",0.08712,{"date":653,"score":497,"percentile":654},"2026-08-25",0.0871,{"date":656,"score":497,"percentile":657},"2026-08-26",0.08737,{"date":659,"score":497,"percentile":657},"2026-08-27",{"date":661,"score":497,"percentile":662},"2026-08-28",0.08748,{"date":664,"score":497,"percentile":665},"2026-08-29",0.08752,{"date":667,"score":497,"percentile":668},"2026-08-30",0.08769,{"date":670,"score":497,"percentile":671},"2026-08-31",0.08768,{"date":673,"score":497,"percentile":674},"2026-09-01",0.08781,{"date":676,"score":497,"percentile":671},"2026-09-02",{"date":678,"score":497,"percentile":665},"2026-09-03",{"date":680,"score":497,"percentile":662},"2026-09-04",{"date":682,"score":497,"percentile":683},"2026-09-05",0.08758,{"date":685,"score":497,"percentile":686},"2026-09-06",0.08779,{"date":688,"score":497,"percentile":689},"2026-09-07",0.08765,{"date":691,"score":497,"percentile":668},"2026-09-08",{"date":693,"score":497,"percentile":694},"2026-09-09",0.08819,{"date":696,"score":497,"percentile":697},"2026-09-10",0.08802,{"date":699,"score":497,"percentile":700},"2026-09-11",0.08794,{"date":702,"score":497,"percentile":703},"2026-09-12",0.08858,{"date":705,"score":497,"percentile":706},"2026-09-13",0.08846,{"date":708,"score":497,"percentile":709},"2026-09-14",0.0886,{"date":711,"score":497,"percentile":712},"2026-09-15",0.08906,{"date":714,"score":497,"percentile":715},"2026-09-16",0.08948,{"date":717,"score":497,"percentile":718},"2026-09-17",0.08978,{"date":720,"score":497,"percentile":721},"2026-09-18",0.09025,{"date":573,"score":497,"percentile":574},[724,731,734,736,738,740,742],{"source":507,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":725,"cvss_v4_0":9},{"baseScore":726,"baseSeverity":727,"vectorString":728,"impactScore":729,"exploitabilityScore":730},4.8,"MEDIUM","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",4.2,5.6,{"source":501,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":732,"cvss_v4_0":9},{"baseScore":499,"baseSeverity":727,"vectorString":502,"impactScore":729,"exploitabilityScore":733},10,{"source":508,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":735,"cvss_v4_0":9},{"baseScore":499,"baseSeverity":9,"vectorString":502,"impactScore":729,"exploitabilityScore":733},{"source":532,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":737,"cvss_v4_0":9},{"baseScore":499,"baseSeverity":9,"vectorString":502,"impactScore":729,"exploitabilityScore":733},{"source":509,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":739,"cvss_v4_0":9},{"baseScore":726,"baseSeverity":9,"vectorString":728,"impactScore":729,"exploitabilityScore":730},{"source":510,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":741,"cvss_v4_0":9},{"baseScore":726,"baseSeverity":9,"vectorString":728,"impactScore":729,"exploitabilityScore":730},{"source":511,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":743,"cvss_v4_0":9},{"baseScore":726,"baseSeverity":9,"vectorString":728,"impactScore":729,"exploitabilityScore":730},[745,757,763,768,772,776,780,784,788,794,798,802,806,810,816,820,824,828,834,840,844,850,854,860,864,870,874,880,886,892,898,910,916,922,928,933,936,939,942,945,948,951,956,959,962,965,976,982,1000,1011],{"ecosystem":746,"name":747,"vendor":748,"product":747,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":747,"source":9,"versions":750},"Chainguard","actions-runner","chainguard","apk",[751],{"version":752,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":755,"version_end_type":756,"fixed_in":9},"lt2_336_0_r5",true,"ecosystem","2.336.0-r5","excluding",{"ecosystem":746,"name":758,"vendor":748,"product":758,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":758,"source":9,"versions":759},"code-server",[760],{"version":761,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":762,"version_end_type":756,"fixed_in":9},"lt4_130_0_r5","4.130.0-r5",{"ecosystem":746,"name":764,"vendor":748,"product":764,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":764,"source":9,"versions":765},"commercial-gitlab-rails-ee-19.1",[766],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":746,"name":769,"vendor":748,"product":769,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":769,"source":9,"versions":770},"commercial-gitlab-rails-ee-19.2",[771],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":773,"vendor":748,"product":773,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":773,"source":9,"versions":774},"commercial-gitlab-rails-ee-19.3",[775],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":777,"vendor":748,"product":777,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":777,"source":9,"versions":778},"commercial-gitlab-rails-ee-fips-19.1",[779],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":781,"vendor":748,"product":781,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":781,"source":9,"versions":782},"commercial-gitlab-rails-ee-fips-19.2",[783],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":785,"vendor":748,"product":785,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":785,"source":9,"versions":786},"commercial-gitlab-rails-ee-fips-19.3",[787],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":789,"vendor":748,"product":789,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":789,"source":9,"versions":790},"kibana-8.19",[791],{"version":792,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":793,"version_end_type":756,"fixed_in":9},"lt8_19_20_r2","8.19.20-r2",{"ecosystem":746,"name":795,"vendor":748,"product":795,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":795,"source":9,"versions":796},"kibana-8.19-bitnami",[797],{"version":792,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":793,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":799,"vendor":748,"product":799,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":799,"source":9,"versions":800},"kibana-8.19-iamguarded",[801],{"version":792,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":793,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":803,"vendor":748,"product":803,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":803,"source":9,"versions":804},"kibana-9.1",[805],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":807,"vendor":748,"product":807,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":807,"source":9,"versions":808},"kibana-9.1-iamguarded",[809],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":811,"vendor":748,"product":811,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":811,"source":9,"versions":812},"kibana-9.2",[813],{"version":814,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":815,"version_end_type":756,"fixed_in":9},"lt9_2_8_r19","9.2.8-r19",{"ecosystem":746,"name":817,"vendor":748,"product":817,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":817,"source":9,"versions":818},"kibana-9.2-iamguarded",[819],{"version":814,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":815,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":821,"vendor":748,"product":821,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":821,"source":9,"versions":822},"kibana-9.3",[823],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":825,"vendor":748,"product":825,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":825,"source":9,"versions":826},"kibana-9.3-iamguarded",[827],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":746,"name":829,"vendor":748,"product":829,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":829,"source":9,"versions":830},"langfuse-3",[831],{"version":832,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":833,"version_end_type":756,"fixed_in":9},"lt3_225_0_r3","3.225.0-r3",{"ecosystem":746,"name":835,"vendor":748,"product":835,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":835,"source":9,"versions":836},"langfuse-3-compat",[837],{"version":838,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":839,"version_end_type":756,"fixed_in":9},"lt3_225_7_r6","3.225.7-r6",{"ecosystem":746,"name":841,"vendor":748,"product":841,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":841,"source":9,"versions":842},"langfuse-3-worker",[843],{"version":832,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":833,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":845,"vendor":748,"product":845,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":845,"source":9,"versions":846},"langfuse-4",[847],{"version":848,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":849,"version_end_type":756,"fixed_in":9},"lt4_3_1_r3","4.3.1-r3",{"ecosystem":746,"name":851,"vendor":748,"product":851,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":851,"source":9,"versions":852},"langfuse-4-worker",[853],{"version":848,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":849,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":855,"vendor":748,"product":855,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":855,"source":9,"versions":856},"langfuse-fips-3",[857],{"version":858,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":859,"version_end_type":756,"fixed_in":9},"lt3_224_3_r9","3.224.3-r9",{"ecosystem":746,"name":861,"vendor":748,"product":861,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":861,"source":9,"versions":862},"langfuse-fips-3-worker",[863],{"version":858,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":859,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":865,"vendor":748,"product":865,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":865,"source":9,"versions":866},"langfuse-fips-4",[867],{"version":868,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":869,"version_end_type":756,"fixed_in":9},"lt4_4_0_r0","4.4.0-r0",{"ecosystem":746,"name":871,"vendor":748,"product":871,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":871,"source":9,"versions":872},"langfuse-fips-4-worker",[873],{"version":868,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":869,"version_end_type":756,"fixed_in":9},{"ecosystem":746,"name":875,"vendor":748,"product":875,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":875,"source":9,"versions":876},"npm-12",[877],{"version":878,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":879,"version_end_type":756,"fixed_in":9},"lt12_0_2_r2","12.0.2-r2",{"ecosystem":746,"name":881,"vendor":748,"product":881,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":881,"source":9,"versions":882},"pelias-api",[883],{"version":884,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":885,"version_end_type":756,"fixed_in":9},"lt7_8_0_r7","7.8.0-r7",{"ecosystem":746,"name":887,"vendor":748,"product":887,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":887,"source":9,"versions":888},"prism",[889],{"version":890,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":891,"version_end_type":756,"fixed_in":9},"lt5_16_0_r2","5.16.0-r2",{"ecosystem":746,"name":893,"vendor":748,"product":893,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":893,"source":9,"versions":894},"pulumi-language-nodejs",[895],{"version":896,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":897,"version_end_type":756,"fixed_in":9},"lt3_256_0_r1","3.256.0-r1",{"ecosystem":746,"name":899,"vendor":748,"product":899,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":899,"source":9,"versions":900},"renovate",[901,904,907],{"version":902,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":903,"version_end_type":756,"fixed_in":9},"lt44_23_3_r1","44.23.3-r1",{"version":905,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":906,"version_end_type":756,"fixed_in":9},"lt44_11_3_r0","44.11.3-r0",{"version":908,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":909,"version_end_type":756,"fixed_in":9},"lt44_11_4_r0","44.11.4-r0",{"ecosystem":746,"name":911,"vendor":748,"product":911,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":911,"source":9,"versions":912},"saf",[913],{"version":914,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":915,"version_end_type":756,"fixed_in":9},"lt1_7_0_r0","1.7.0-r0",{"ecosystem":746,"name":917,"vendor":748,"product":917,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":917,"source":9,"versions":918},"vitess-24",[919],{"version":920,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":921,"version_end_type":756,"fixed_in":9},"lt24_0_2_r10","24.0.2-r10",{"ecosystem":746,"name":923,"vendor":748,"product":923,"cpe_part":9,"purl_type":749,"purl_namespace":748,"purl_name":923,"source":9,"versions":924},"vitess-24-compat",[925],{"version":926,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":927,"version_end_type":756,"fixed_in":9},"lt24_0_3_r7","24.0.3-r7",{"ecosystem":929,"name":758,"vendor":930,"product":758,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":758,"source":9,"versions":931},"Wolfi","wolfi",[932],{"version":761,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":762,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":829,"vendor":930,"product":829,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":829,"source":9,"versions":934},[935],{"version":832,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":833,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":835,"vendor":930,"product":835,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":835,"source":9,"versions":937},[938],{"version":838,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":839,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":841,"vendor":930,"product":841,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":841,"source":9,"versions":940},[941],{"version":832,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":833,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":875,"vendor":930,"product":875,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":875,"source":9,"versions":943},[944],{"version":878,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":879,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":887,"vendor":930,"product":887,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":887,"source":9,"versions":946},[947],{"version":890,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":891,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":893,"vendor":930,"product":893,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":893,"source":9,"versions":949},[950],{"version":896,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":897,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":899,"vendor":930,"product":899,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":899,"source":9,"versions":952},[953,954,955],{"version":902,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":903,"version_end_type":756,"fixed_in":9},{"version":905,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":906,"version_end_type":756,"fixed_in":9},{"version":908,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":909,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":911,"vendor":930,"product":911,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":911,"source":9,"versions":957},[958],{"version":914,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":915,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":917,"vendor":930,"product":917,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":917,"source":9,"versions":960},[961],{"version":920,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":921,"version_end_type":756,"fixed_in":9},{"ecosystem":929,"name":923,"vendor":930,"product":923,"cpe_part":9,"purl_type":749,"purl_namespace":930,"purl_name":923,"source":9,"versions":963},[964],{"version":926,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":927,"version_end_type":756,"fixed_in":9},{"ecosystem":966,"name":967,"vendor":968,"product":967,"cpe_part":9,"purl_type":969,"purl_namespace":968,"purl_name":967,"source":9,"versions":970},"Debian","node-undici","debian","deb",[971,972,973],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":974,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":975,"version_end_type":756,"fixed_in":9},"lt8_9_0+dfsg+~cs3_2_0_1","8.9.0+dfsg+~cs3.2.0-1",{"ecosystem":977,"name":967,"vendor":978,"product":967,"cpe_part":9,"purl_type":969,"purl_namespace":978,"purl_name":967,"source":9,"versions":979},"Ubuntu","ubuntu",[980,981],{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":767,"is_range":753,"range_type":754,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":983,"vendor":984,"product":983,"cpe_part":985,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":986},"undici","nodejs","a",[987,991,996],{"version":988,"is_range":753,"range_type":989,"version_start":9,"version_start_type":9,"version_end":990,"version_end_type":756,"fixed_in":9},"lt6.28.0","cpe","6.28.0",{"version":992,"is_range":753,"range_type":989,"version_start":993,"version_start_type":994,"version_end":995,"version_end_type":756,"fixed_in":9},"gte7.0.0_lt7.29.0","7.0.0","including","7.29.0",{"version":997,"is_range":753,"range_type":989,"version_start":998,"version_start_type":994,"version_end":999,"version_end_type":756,"fixed_in":9},"gte8.0.0_lt8.9.0","8.0.0","8.9.0",{"ecosystem":1001,"name":983,"vendor":1001,"product":983,"cpe_part":9,"purl_type":1002,"purl_namespace":9,"purl_name":983,"source":9,"versions":1003},"Npm","npm",[1004,1007,1009],{"version":1005,"is_range":753,"range_type":1006,"version_start":9,"version_start_type":9,"version_end":990,"version_end_type":756,"fixed_in":9},"lt6_28_0","semver",{"version":1008,"is_range":753,"range_type":1006,"version_start":993,"version_start_type":994,"version_end":995,"version_end_type":756,"fixed_in":9},"gte7_0_0_lt7_29_0",{"version":1010,"is_range":753,"range_type":1006,"version_start":998,"version_start_type":994,"version_end":999,"version_end_type":756,"fixed_in":9},"gte8_0_0_lt8_9_0",{"ecosystem":9,"name":983,"vendor":983,"product":983,"cpe_part":985,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1012},[1013,1015,1017],{"version":1014,"is_range":753,"range_type":507,"version_start":9,"version_start_type":9,"version_end":990,"version_end_type":756,"fixed_in":9},"\u003C 6.28.0",{"version":1016,"is_range":753,"range_type":507,"version_start":993,"version_start_type":994,"version_end":995,"version_end_type":756,"fixed_in":9},">= 7.0.0, \u003C 7.29.0",{"version":1018,"is_range":753,"range_type":507,"version_start":998,"version_start_type":994,"version_end":999,"version_end_type":756,"fixed_in":9},">= 8.0.0, \u003C 8.9.0"]