Your dependencies cross-checked against the OSV vulnerability database.
-
Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
-
Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
-
Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
-
Worth fixing GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mwp4-54f8-5fhr ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-69192). Fix: Update that package to its patched version.
-
Worth fixing GHSA-v2v4-37r5-5v8g ip-address has XSS in Address6 HTML-emitting methods
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-42338). Fix: Update that package to its patched version.
-
Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
-
Worth fixing GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
-
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
-
Worth fixing GHSA-34x7-hfp2-rc4v node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-24842). Fix: Update that package to its patched version.
-
Worth fixing GHSA-83g3-92jg-28cx Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-26960). Fix: Update that package to its patched version.
-
Worth fixing GHSA-8qq5-rm4j-mr97 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-23745). Fix: Update that package to its patched version.
-
Worth fixing GHSA-8x88-c5mf-7j5w node-tar: Negative tar entry size causes infinite loop in archive replace
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-59874). Fix: Update that package to its patched version.
-
Worth fixing GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-31802). Fix: Update that package to its patched version.
-
Worth fixing GHSA-gvwx-54wh-qm9j node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-59875). Fix: Update that package to its patched version.
-
Worth fixing GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-29786). Fix: Update that package to its patched version.
-
Worth fixing GHSA-r292-9mhp-454m node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole. Fix: Update that package to its patched version.
-
Worth fixing GHSA-r6q2-hw4h-h46w Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-23950). Fix: Update that package to its patched version.
-
Worth fixing GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-53655). Fix: Update that package to its patched version.
-
Worth fixing GHSA-w8wr-v893-vjvp node-tar: Process crash via PAX numeric path type confusion
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2026-59871). Fix: Update that package to its patched version.
-
Worth fixing GHSA-vj76-c3g6-qr5v tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
/workdirs/scan-7d6827c8-53c2-464c-8088-9f78fa3d7db4/package-lock.json
A package you depend on has a known security hole (CVE-2025-59343). Fix: Update that package to its patched version.