# Security changelog 1.6.0

Vulnerabilities fixed since version 1.5.1.

Fixed: 4

| Vulnerability | Severity | Package (previous version) | Platform | Summary |
|---|---|---|---|---|
| [CVE-2026-93687](https://nvd.nist.gov/vuln/detail/CVE-2026-93687) | 8.7 | npm/braces@3.0.3 | arm64, x64 | braces vulnerable to stack-exhaustion denial of service through deeply nested patterns |
| [CVE-2026-93748](https://nvd.nist.gov/vuln/detail/CVE-2026-93748) | 8.7 | npm/http-cache-semantics@4.2.0 | arm64, x64 | http-cache-semantics max-stale handling can disclose cross-user cached responses |
| [CVE-2026-42497](https://nvd.nist.gov/vuln/detail/CVE-2026-42497) | 7.5 | Ubuntu:26.04:LTS/perl@5.40.1-7ubuntu0.3 | arm64, x64 |  |
| [CVE-2026-97058](https://nvd.nist.gov/vuln/detail/CVE-2026-97058) | 6.9 | npm/sprintf-js@1.0.3, npm/sprintf-js@1.1.3 | arm64, x64 | sprintf-js vulnerable to denial of service through unbounded precision specifiers |