PT-2026-100447

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102190

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100548

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100750

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101997

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101510

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101661

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Undici TLS SOCKS5 Proxy

The vulnerability of the TLS connection mechanism through SOCKS5 proxy HTTP clients in the Undici software platform NodeJS is related to errors in the certificate authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the...

PT-2026-101003

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Fedora 43 : nodejs-undici (2026-67f78e732b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-67f78e732b advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

PT-2026-101209

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Malicious Package

Overview leda-nodejs-nextjs-sirius is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Fedora 45 : nodejs-undici (2026-25a6102ac6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-25a6102ac6 advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1. An upgraded version of the package is available that resolves this issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt service availability ...

AZL-104937 CVE-2026-91728 affecting package nodejs 24.21.0-1

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Node.js

The generateKeys API function returned by crypto.createDiffieHellman only generates missing or outdated keys. In other words, it only generates a private key if none has been set yet. However, this function is also needed to compute the corresponding public key after calling setPrivateKey...

AZL-103380 CVE-2026-25832 affecting package nodejs 24.20.0-1

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...

AlmaLinux 9 : nodejs:22 (ALSA-2026:55601)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55601 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

AlmaLinux 8 : nodejs:22 (ALSA-2026:54530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...