5602 matches found
nodejs:24 security update
nodejs 1:24.18.0-2 - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-194176 RHEL-194179 RHEL-208658 1:24.18.0-1 - Update to version 24.18.0 Resolves: RHEL-168744 1:24.14.1-2 - Update bundled nghttp2 to 1.68.1 Related: RHEL-151374 1:24.14.1-1 -...
nodejs:22 security update
nodejs 1:22.23.1-2 - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled brace-expansion Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680 1:22.23.1-1 ...
nodejs:22 security update
nodejs 1:22.23.1-2 - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-193842 RHEL-193874 RHEL-208661 1:22.23.1-1 - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930...
axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter
A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...
CVE-2026-14893
IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...
nodejs:24 security update
An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
Important: Red Hat Security Advisory: nodejs:22 security update
An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: nodejs:24 security update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
NPM package.json Disclosure Detection
All NodeJS packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project generated by package managers such as npm, yarn, pnpm. !/usr/bin/env python3 -- coding: utf-8 -- """All NodeJS packages contain a file, usually in the...
node-srv - Local File Inclusion Detection
node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. !/usr/bin/env python3 -- coding: utf-8 -- """node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a...
Malicious Package
Overview hermes-celeste-react-bootstrap-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...
CVE-2026-55968
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.6.hum1 noarch nodejs24-devel-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.6.hum1 noarch...
GHSA-VH45-F885-3848 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...
NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.1-2.3.hum1 noarch nodejs22-devel-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.1-2.3.hum1 noarch...
Uncontrolled Recursion
Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An...
AZL-94535 CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...