jquery/jquery

brace-expansion 1.1.15

3 advisories. Fixed in 5.0.7.

How it can be abusedThis library is only used behind the scenes by build and test tooling that matches file paths, such as glob and minimatch. A malicious or corrupted input like a crafted filename or config could make those tools hang or run out of memory, freezing builds on developer machines or CI servers; people visiting sites built with jQuery are not affected.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

fast-uri 3.1.2

3 advisories. Fixed in 4.0.1.

How it can be abusedfast-uri parses web addresses and can be tricked into treating a malicious address as belonging to a trusted host, which could let an attacker bypass checks that rely on comparing URLs. However, jQuery does not depend on this library and runs entirely in the browser, so this flaw has no practical effect on this codebase or its users.

• highGHSA-4c8g-83qw-93j6fast-uri vulnerable to host confusion via failed IDN canonicalization
• highGHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
• highGHSA-v2hh-gcrm-f6hxfast-uri vulnerable to host confusion via literal backslash authority delimiter

ip-address 10.2.0

1 advisory. Fixed in 10.3.1.

How it can be abusedAn attacker could trick code that checks IP addresses into approving an address that means something different to the real resolver, letting requests reach internal systems that were supposed to be blocked. In this repository the library is not part of what ships to users; at most it appears in development or test tooling, so end users of jQuery are not affected.

• highGHSA-mwp4-54f8-5fhrip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

js-yaml 4.2.0

2 advisories. Fixed in 3.15.0.

How it can be abusedA malicious YAML file, such as a crafted test fixture or config checked into the repo, could make the js-yaml parser burn huge amounts of CPU during the build or test pipeline, slowing or hanging developer machines and CI. Only people running the project's own build and test scripts are affected; nothing ships to browser users.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

serialize-javascript 6.0.2

1 advisory. Fixed in 7.0.3.

How it can be abusedThis package turns JavaScript values into strings and can be tricked into running attacker code if it serializes data an attacker controls. In this repo it is only a build-time tool handling trusted local files during bundling, so real-world users of the jQuery library are not exposed.

• highGHSA-5c6j-r48x-rmvqSerialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

shell-quote 1.8.4

1 advisory. Fixed in 1.9.0.

How it can be abusedAn attacker could feed a very long or tricky string into the shell-quote parse function, making it slow down dramatically and freeze whatever process called it. In this repo shell-quote is only used in developer and build tooling, so real users of jQuery in browsers are not affected; only developers running local builds or tests could be inconvenienced.

• highGHSA-395f-4hp3-45gvshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

undici 7.24.5

4 advisories. Fixed in 7.29.0.

How it can be abusedThis package is only used in the Node.js build and test tooling, never in the browser code that ships to websites. An attacker could only abuse these flaws if a developer or CI job ran tests that connect to a malicious server, which could leak responses between users, skip certificate checks, or crash the test process; end users of jQuery are not affected.

• highGHSA-4cwx-7wf7-3272undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
• highGHSA-hm92-r4w5-c3mjundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
• highGHSA-vmh5-mc38-953gundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
• highGHSA-vxpw-j846-p89qundici WebSocket client vulnerable to denial of service via fragment count bypass