CVE-2026-103921: Improper Certificate Validation

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783676351)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783676351 advisory. - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2023_1583)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231583 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 http-cache-semantics: Regular Expression Denial of Service ReDoS vulnerability...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772125283)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772125283 advisory. - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783342928)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783342928 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_7896)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267896 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772125283)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772125283 advisory. - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1753208069)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753208069 advisory. - The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_8339)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268339 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...

Rocky Linux 10.1 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-devel / nodejs-docs / etc Multiple Vulnerabilities (crlsa-2026_7080)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267080 advisory. brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion CVE-2026-25547 minimatch: minimatch: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_2654)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20232654 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 c-ares: buffer overflow in configsortlist due to missing string length check CVE-2022-4904...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1770216227)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770216227 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1770216227)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770216227 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operatio...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1770717358)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770717358 advisory. - Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1762361695)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762361695 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788430709)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788430709 advisory. - A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783676351)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783676351 advisory. - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1775220180)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775220180 advisory. - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_7302)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267302 advisory. brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion CVE-2026-25547 minimatch: minimatch: Denial of Service via speciall...

Linux Distros Unpatched Vulnerability : CVE-2026-102990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a...