CLEANSTART-2026-SO42358 Security fixes in nodejs 14.16.1-r0

Package nodejs version 14.16.1-r0 fixes 1 vulnerabilities: CVE-2020-7774...

CLEANSTART-2026-LH82382 Security fixes in nodejs 12.15.0-r0

Package nodejs version 12.15.0-r0 fixes 3 vulnerabilities: CVE-2019-15606, CVE-2019-15605, CVE-2019-15604...

CLEANSTART-2026-CW77982 Security fixes in nodejs 14.15.1-r0

Package nodejs version 14.15.1-r0 fixes 1 vulnerabilities: CVE-2020-8277...

CLEANSTART-2026-FI53720 Security fixes in nodejs 18.18.2-r0

Package nodejs version 18.18.2-r0 fixes 3 vulnerabilities: CVE-2023-45143, CVE-2023-38552, CVE-2023-39333...

ALPINE-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-56850

CVE-2026-56850 affects Node.js 22.x, 24.x, and 26.x. The issue is in the HTTPS Agent’s connection reuse, where PFX object-array key collisions can cause mutual TLS (mTLS) client identities to be reused across requests with different client certificates. This could enable cross-certificate identit...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-56847

creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:47+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...

CVE-2026-56850

creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:42+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...

CVE-2026-58044

creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:25+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

[SECURITY] Fedora 44 Update: nodejs24-24.18.0-1.fc44

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

RHEL 10 : nodejs24 (RHSA-2026:48034)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48034 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...

RockyLinux 10 : nodejs-nodemon (RLSA-2026:48032)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:48032 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 Tenable has extracted the preceding description block...

PT-2026-66408

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Node.js HTTPS Agent connection reuse mechanism can lead to PFX object-array key collisions. This issue allows mutual TLS mTLS client identities to be...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.2-2.3.hum1 noarch nodejs22-devel-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.2-2.3.hum1 noarch...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...