PT-2026-100651

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101690

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101553

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101438

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101878

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100750

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101061

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102230

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100292

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100345

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100204

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101634

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Malicious Package

Overview leda-nodejs-nextjs-sirius is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Fedora 45 : nodejs-undici (2026-25a6102ac6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-25a6102ac6 advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1. An upgraded version of the package is available that resolves this issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt service availability ...

AZL-104937 CVE-2026-91728 affecting package nodejs 24.21.0-1

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Node.js

The generateKeys API function returned by crypto.createDiffieHellman only generates missing or outdated keys. In other words, it only generates a private key if none has been set yet. However, this function is also needed to compute the corresponding public key after calling setPrivateKey...

AZL-103380 CVE-2026-25832 affecting package nodejs 24.20.0-1

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...

AlmaLinux 8 : nodejs:22 (ALSA-2026:54530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...