Oracle Linux 8 : nodejs:22 (ELSA-2026-41947)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41947 advisory. - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619...

nodejs:22 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: renovate, saf, actions-runner, node-gyp, gemini-cli, npm, py3-captum, haraka, kibana, pelias-api, prism, code-server, vitess...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: npm, saf, prism, renovate, node-gyp, code-server, vitess...

Linux Distros Unpatched Vulnerability : CVE-2026-12151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of...

@0xwork/connect (>=0.1.0 <=0.1.9), @1001-digital/components.evm (>=1.3.0 <=3.6.11) +1373 more potentially affected by CVE-2026-12151 via undici (>=8.0.0 <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =1.3.0, =0.1.0, =1.2.2, =0.3.0, =0.3.0, =0.3.1, =5.0.1-staging.3edc9d7b8d6f, =5.0.1-staging.3edc9d7b8d6f, =5.1.1-staging.0ad6ac75ae4a, =5.1.1-staging.0ad6ac75ae4a, =5.0.1-staging.4b92bc7a3e3b, =5.0.1-staging.3abdf9534c25, =2026.6.2, =2026.6.5 and more Source cve...

002-globals (=1.0.0), 007putra-my-bot (=1.1.1) +36331 more potentially affected by CVE-2026-12151 via undici (>=7.0.0 <=7.27.2)

undici NPM version =7.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =0.3.96, =0.0.1, =0.0.9 - 2017-1535 =1.0.0 and more Source cves: CVE-2026-12151 Source advisory: OSV:GHSA-VXPW-J846-P89Q...

0utmailauth (=1.0.0), 0xkobold (>=0.0.1 <=0.8.0) +4815 more potentially affected by CVE-2026-12151 via undici (>=6.0.0 <=6.25.0)

undici NPM version =6.0.0, =0.0.1, =1.0.1, =1.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =0.5.119 and more Source cves: CVE-2026-12151 Source advisory: SNYK:JS-UNDICI-17372754...

org.webjars.npm:actions__core (>=1.10.0 <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1 <=2.2.3) +14 more potentially affected by CVE-2026-12151 via org.webjars.npm:undici (>=4.12.2 <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch =8.6.0 - org.webjars.npm:elastictransport =8.3.1 - org.webjars.npm:firebase =10.13.0 - org.webjars.npm:firebaseauth =1.7.7 - org.webjars.npm:firebaseauth-compat =0.5.12 -...

DEBIAN-CVE-2026-12151

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size...

CVE-2026-12151

creationtimestamp| type| source ---|---|--- 2026-06-17 16:12:44+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3moipe7e5is2g 2026-06-17 18:55:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiyi3y4jq27 2026-06-18 15:59:01+00:00| seen|...

CVE-2026-12151

The CVE affects the undici WebSocket client (and WebSocketStream API) where maxPayloadSize is enforced per-frame but there is no limit on the number of fragments in a message. A malicious server can send many small or empty continuation frames, each passing validation, causing unbounded memory gr...

EUVD-2017-6555

Malware in sbrugna...

CVE-2024-12151

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets...

CVE-2024-12151

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets...

CVE-2024-12151

creationtimestamp| type| source ---|---|--- 2024-12-04 17:42:36+00:00| seen| https://infosec.exchange/users/cve/statuses/113595787225996422 2024-12-04 20:06:41+00:00| seen| https://t.me/cvedetector/12024...