Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...

SUSE-SU-2026:5037-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...

SUSE-SU-2026:5036-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...

CVE-2025-32462-

CVE-2025-32462 – Sudo Hostname Bypass Privilege Escalation Table of Contents 1. Overview 2. Vulnerability Details 3. Impact 4. Lab Environment 5. Verification of Vulnerable Version 6. User & sudoers Configuration 7. Exploitation Walkthrough 8. Proof of Concept Summary 9. Why Ubuntu Is Not...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, module.nodejs-nodemon, nodejs, module.nodejs-packaging, nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...

Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS Certificate Hostname Bypass

The version of Node.js installed on the remote host is 24.x prior to 24.22.1 or 26.x prior to 26.12.1. It is, therefore, affected by a TLS certificate hostname bypass vulnerability as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - TLS certificate hostname verification...

Node.js -- multiple vulnerabilities

Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS certificate hostname bypass when the IP is written fullwidth digits CVE-2026-105483 - high TLS certificate hostname bypass when the host loosely resolves to an IP address CVE-2026-106069 - high Node.js...

PT-2026-120762

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x through 22.23.3 Node.js versions 24.x through 24.22.0 Node.js versions 26.x through 26.12.0 Description A flaw in the crypto module causes internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and...

CVE-2026-100849

AzuraCast, a self-hosted web radio management suite, is vulnerable to Server-Side Request Forgery (SSRF) in versions before 0.23.8 . The flaw exists in the AbstractConnector::getValidUrl() function (backend/src/Webhook/Connector/AbstractConnector.php) used by the Generic and Discord webhook conne...

CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

Node.js: TLS certificate hostname bypass when the IP is written fullwidth digits

A flaw was discovered in TLS hostname verification that allowed a certificate without a matching IP address to authenticate connections when the host was written using non-ASCII characters. The verification function failed to recognize such hosts as IP addresses and instead matched them against...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

Snowflake Connector for Python improperly verifies TLS hostnames

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...