{"action":"Upgrade muhammara to 6.0.5 or later.","affected":[{"fixed":"6.0.5","introduced":"0"}],"component":"muhammara","cve_ids":["CVE-2026-125107"],"ecosystem":"npm","epss":0.00339,"exploited":false,"fixed_versions":["6.0.5"],"ghsa_id":"GHSA-fhp4-pr5j-46m5","id":"tcs_01M5KFNKX3S3G6YT9B0J7W7KNG","modified_at":"2026-11-09T21:45:11.101513709Z","published_at":"2026-06-26T20:55:18Z","references":["https://osv.dev/vulnerability/GHSA-fhp4-pr5j-46m5","https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b","https://github.com/julianhille/MuhammaraJS"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fhp4-pr5j-46m5","url":"https://osv.dev/vulnerability/GHSA-fhp4-pr5j-46m5"}],"summary":"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"}