GHSA-gmq8-994r-jv83
Medium · 5.3CVSS
5.3
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
yauzl contains an off-by-one error
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | yauzl | 3.2.0 | 3.2.1 |
| Chainguard | code-server | 0 | 4.110.1-r1 |
| Chainguard | foxx-cli | 0 | 2.1.1-r4 |
| Chainguard | gemini-cli | 0 | 0.33.2-r0 |
| Chainguard | kibana-7 | 0 | 7.17.29-r7 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r12 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r12 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r12 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r10 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r10 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r10 |
| Chainguard | kibana-8.19 | 0 | 8.19.13-r0 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.13-r0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.13-r0 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r13 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r13 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r13 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 0 | 9.2.7-r0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.6-r3 |
| Chainguard | kibana-9.3 | 0 | 9.3.2-r0 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.2-r0 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r13 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r16 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r8 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r5 |
| Chainguard | renovate | 0 | 43.77.0-r0 |
| Wolfi | code-server | 0 | 4.110.1-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.5-r1 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r8 |
| Wolfi | renovate | 0 | 43.77.0-r0 |
Related vulnerabilities
- CVE-2026-31988 yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one… Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects code-server
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects code-server
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects code-server
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects code-server
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects code-server
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects code-server
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects code-server