Vulnerable Library - localize-16.1.4.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (localize version) |
Remediation Possible** |
| CVE-2026-73089 |
 High |
7.5 |
browserslist-4.22.1.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-73088 |
High |
7.5 |
browserslist-4.22.1.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-33671 |
High |
7.5 |
picomatch-2.3.1.tgz |
Transitive |
N/A* |
❌ |
| CVE-2024-4068 |
High |
7.5 |
braces-3.0.2.tgz |
Transitive |
N/A* |
❌ |
| CVE-2025-27789 |
 Medium |
6.2 |
helpers-7.23.2.tgz |
Transitive |
16.1.5 |
❌ |
| CVE-2026-33672 |
Medium |
5.3 |
picomatch-2.3.1.tgz |
Transitive |
N/A* |
❌ |
| CVE-2024-4067 |
Medium |
5.3 |
micromatch-4.0.5.tgz |
Transitive |
16.1.5 |
❌ |
| CVE-2026-49356 |
 Low |
3.2 |
core-7.22.5.tgz |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-73089
Vulnerable Library - browserslist-4.22.1.tgz
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.22.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- core-7.22.5.tgz
- helper-compilation-targets-7.22.15.tgz
- ❌ browserslist-4.22.1.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct "(queries, context)" result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since "--" queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Publish Date: 2026-08-11
URL: CVE-2026-73089
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c83g-rgw3-j3cx
Release Date: 2026-08-11
Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7
Step up your Open Source Security Game with Mend here
CVE-2026-73088
Vulnerable Library - browserslist-4.22.1.tgz
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.22.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- core-7.22.5.tgz
- helper-compilation-targets-7.22.15.tgz
- ❌ browserslist-4.22.1.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-11
URL: CVE-2026-73088
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-73wf-gq98-2v4g
Release Date: 2026-08-11
Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7
Step up your Open Source Security Game with Mend here
CVE-2026-33671
Vulnerable Library - picomatch-2.3.1.tgz
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/picomatch/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- fast-glob-3.2.12.tgz
- micromatch-4.0.5.tgz
- ❌ picomatch-2.3.1.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as "+()" and "()", especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to "picomatch" for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to "picomatch". Possible mitigations include disabling extglob support for untrusted patterns by using "noextglob: true", rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as "+()" and "()", enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.
Publish Date: 2026-03-26
URL: CVE-2026-33671
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 2.3.2
Step up your Open Source Security Game with Mend here
CVE-2024-4068
Vulnerable Library - braces-3.0.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/braces/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- fast-glob-3.2.12.tgz
- micromatch-4.0.5.tgz
- ❌ braces-3.0.2.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Publish Date: 2024-05-13
URL: CVE-2024-4068
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: braces - 3.0.3
Step up your Open Source Security Game with Mend here
CVE-2025-27789
Vulnerable Library - helpers-7.23.2.tgz
Library home page: https://registry.npmjs.org/@babel/helpers/-/helpers-7.23.2.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/@babel/helpers/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- core-7.22.5.tgz
- ❌ helpers-7.23.2.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the ".replace" method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to ".replace"). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the ".replace" method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of ".replace". This problem has been fixed in "@babel/helpers" and "@babel/runtime" 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on "@babel/helpers", and instead depend on "@babel/core" (which itself depends on "@babel/helpers"). Upgrading to "@babel/core" 7.26.10 is not required, but it guarantees use of a new enough "@babel/helpers" version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
Publish Date: 2025-03-11
URL: CVE-2025-27789
CVSS 3 Score Details (6.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-968p-4wvh-cqc8
Release Date: 2025-03-11
Fix Resolution (@babel/helpers): 7.26.10
Direct dependency fix Resolution (@angular/localize): 16.1.5
Step up your Open Source Security Game with Mend here
CVE-2026-33672
Vulnerable Library - picomatch-2.3.1.tgz
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/picomatch/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- fast-glob-3.2.12.tgz
- micromatch-4.0.5.tgz
- ❌ picomatch-2.3.1.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the "POSIX_REGEX_SOURCE" object. Because the object inherits from "Object.prototype", specially crafted POSIX bracket expressions (e.g., "[[:constructor:]]") can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected "picomatch" versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like "[[:...:]]"; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying "POSIX_REGEX_SOURCE" to use a null prototype.
Publish Date: 2026-03-26
URL: CVE-2026-33672
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/micromatch/picomatch.git - 2.3.2,https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4
Step up your Open Source Security Game with Mend here
CVE-2024-4067
Vulnerable Library - micromatch-4.0.5.tgz
Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/micromatch/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- fast-glob-3.2.12.tgz
- ❌ micromatch-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
The NPM package "micromatch" prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in "micromatch.braces()" in "index.js" because the pattern ".*" will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Publish Date: 2024-05-13
URL: CVE-2024-4067
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution (micromatch): 4.0.8
Direct dependency fix Resolution (@angular/localize): 16.1.5
Step up your Open Source Security Game with Mend here
CVE-2026-49356
Vulnerable Library - core-7.22.5.tgz
Library home page: https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/@babel/core/package.json
Dependency Hierarchy:
- localize-16.1.4.tgz (Root Library)
- ❌ core-7.22.5.tgz (Vulnerable Library)
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
Publish Date: 2026-06-22
URL: CVE-2026-49356
CVSS 3 Score Details (3.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/babel/babel.git - 7.29.6,https://github.com/babel/babel.git - 8.0.0-rc.6
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - browserslist-4.22.1.tgz
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.22.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct "(queries, context)" result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since "--" queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Publish Date: 2026-08-11
URL: CVE-2026-73089
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c83g-rgw3-j3cx
Release Date: 2026-08-11
Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - browserslist-4.22.1.tgz
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.22.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-11
URL: CVE-2026-73088
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-73wf-gq98-2v4g
Release Date: 2026-08-11
Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - picomatch-2.3.1.tgz
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/picomatch/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as "+()" and "()", especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to "picomatch" for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to "picomatch". Possible mitigations include disabling extglob support for untrusted patterns by using "noextglob: true", rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as "+()" and "()", enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.
Publish Date: 2026-03-26
URL: CVE-2026-33671
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 2.3.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - braces-3.0.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/braces/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Publish Date: 2024-05-13
URL: CVE-2024-4068
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: braces - 3.0.3
Step up your Open Source Security Game with Mend here
Vulnerable Library - helpers-7.23.2.tgz
Library home page: https://registry.npmjs.org/@babel/helpers/-/helpers-7.23.2.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/@babel/helpers/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the ".replace" method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to ".replace"). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the ".replace" method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of ".replace". This problem has been fixed in "@babel/helpers" and "@babel/runtime" 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on "@babel/helpers", and instead depend on "@babel/core" (which itself depends on "@babel/helpers"). Upgrading to "@babel/core" 7.26.10 is not required, but it guarantees use of a new enough "@babel/helpers" version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
Publish Date: 2025-03-11
URL: CVE-2025-27789
CVSS 3 Score Details (6.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-968p-4wvh-cqc8
Release Date: 2025-03-11
Fix Resolution (@babel/helpers): 7.26.10
Direct dependency fix Resolution (@angular/localize): 16.1.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - picomatch-2.3.1.tgz
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/picomatch/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the "POSIX_REGEX_SOURCE" object. Because the object inherits from "Object.prototype", specially crafted POSIX bracket expressions (e.g., "[[:constructor:]]") can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected "picomatch" versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like "[[:...:]]"; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying "POSIX_REGEX_SOURCE" to use a null prototype.
Publish Date: 2026-03-26
URL: CVE-2026-33672
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/micromatch/picomatch.git - 2.3.2,https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4
Step up your Open Source Security Game with Mend here
Vulnerable Library - micromatch-4.0.5.tgz
Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/micromatch/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
The NPM package "micromatch" prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in "micromatch.braces()" in "index.js" because the pattern ".*" will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Publish Date: 2024-05-13
URL: CVE-2024-4067
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution (micromatch): 4.0.8
Direct dependency fix Resolution (@angular/localize): 16.1.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - core-7.22.5.tgz
Library home page: https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /node_modules/@babel/core/package.json
Dependency Hierarchy:
Found in HEAD commit: 924aa2c29ab21a422a96a7a2e29ae0c459bcce8d
Found in base branch: main
Vulnerability Details
Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
Publish Date: 2026-06-22
URL: CVE-2026-49356
CVSS 3 Score Details (3.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/babel/babel.git - 7.29.6,https://github.com/babel/babel.git - 8.0.0-rc.6
Step up your Open Source Security Game with Mend here