5829 matches found
Important: Red Hat Security Advisory: nodejs:22 security update
An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: nodejs:24 security update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
NPM package.json Disclosure Detection
All NodeJS packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project generated by package managers such as npm, yarn, pnpm. !/usr/bin/env python3 -- coding: utf-8 -- """All NodeJS packages contain a file, usually in the...
node-srv - Local File Inclusion Detection
node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. !/usr/bin/env python3 -- coding: utf-8 -- """node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a...
Malicious code in field-upload-tool (npm)
Source: amazon-inspector 17402ad5019d1d433139ce2652d18d2493d87acfd1ede435a94c87eb421f25b1 On every npm install, the package's postinstall lifecycle script in package.json spawns a detached, unref'd Node process that decodes a base64-encoded payload via node -e Buffer.from...,'base64'.toString and...
Malicious code in @torbeck/heap (npm)
Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets homepage/repository/bugs to github.com/datastructures-js/heap and...
Malicious Package
Overview hermes-celeste-react-bootstrap-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...
CVE-2026-55968
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.6.hum1 noarch nodejs24-devel-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.6.hum1 noarch...
Malicious code in @amiga-fwk-nodejs/metrics (npm)
The package @amiga-fwk-nodejs/metrics was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in @amiga-fwk-nodejs/log (npm)
The package @amiga-fwk-nodejs/log was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in 8888acc-utility-service-nodejs-clien (npm)
The package 8888acc-utility-service-nodejs-clien was found to contain malicious code. --- Credit: OpenSSF source...
GHSA-VH45-F885-3848 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...
NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.1-2.3.hum1 noarch nodejs22-devel-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.1-2.3.hum1 noarch...
Uncontrolled Recursion
Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An...
AZL-94535 CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
