Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.3.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.3.hum1 noarch nodejs24-devel-24.18.0-0.3.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.3.hum1 noarch...

Oracle Linux 9 : nodejs:24 (ELSA-2026-35891)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35891 advisory. nodejs 1:24.18.0-1 - Update to version 24.18.0 nodejs-nodemon 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fix BR for nodejs-npm nodejs-packaging 2021.06-6...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.5.0-1.3.hum1 aarch64, x8664 nodejs26-bin-26.5.0-1.3.hum1 noarch nodejs26-devel-26.5.0-1.3.hum1 aarch64, x8664 nodejs26-docs-26.5.0-1.3.hum1 noarch...

MAL-2026-10153 Malicious code in notifier-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c The package presents itself as a pino-compatible logger main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as...

MAL-2026-10131 Malicious code in express-session-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 076f813c0d0a60ee43f7a73f8aad609e5043cd8d92b57b5c3c3c08954accbb4f The package impersonates the popular express-session library by copying its name pattern, author metadata TJ Holowaychuk , and repository field...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.4.0-1.4.hum1 aarch64, x8664 nodejs26-bin-26.4.0-1.4.hum1 noarch nodejs26-devel-26.4.0-1.4.hum1 aarch64, x8664 nodejs26-docs-26.4.0-1.4.hum1 noarch...

MAL-2026-10058 Malicious code in cookie-js-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...

Oracle Linux 9 : nodejs:22 (ELSA-2026-35892)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35892 advisory. - Update to version 22.23.1 Resolves: RHEL-186622 RHEL-185998 RHEL-183669 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937...

CVE-2026-49866

CVE-2026-49866 affects the JavaScript libp2p implementation, specifically the @libp2p/gossipsub component. The root cause is defaultDecodeRpcLimits allowing maxIhaveMessageIDs and maxIwantMessageIDs to be Infinity prior to v16.0.0, enabling oversized IHAVE/IWANT control message arrays in message/...

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48618 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48618 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48619 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48619 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48928 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48928 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48937 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48937 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48933 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48933 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48935 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48935 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48615 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48615 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48617 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48617 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

RLSA-2026:35842 Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...