CVE-2026-94448
EPSS 0.3%Vendor advisory churn dominates; low EPSS; no PoC or active exploitation evidence.
What: JavaScript template-literal expression parser context-tracking flaw in Apigee hybrid v1.15.8 and earlier; improper regex literal escape handling; no published CVSS/EPSS severity data.
Why it matters: Google released Apigee hybrid v1.15.9 on 2026-10-21 addressing this CVE alongside eight others. Not KEV-listed; no public PoC or in-the-wild exploitation reported. Vendor patching is routine and timely, but the low EPSS (0.002) and absence of exploitation chatter suggest limited real-world risk surface.
Where it's seen: Repetitive Bluesky posts listing CVE-2026-94448 bundled across multiple Apigee components (watcher, runtime, redis, prometheus, cassandra, fluent-bit, istiod) in vendor security advisories. No independent researcher PoC or defender triage questions visible.
RISK: LOW — Narrow JavaScript parser scope; routine patch release; no exploitation signal or KEV listing.
Description
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.