CVE-2026-56850 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-58043 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-777R-4CWX-G26V vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-QRQ2-C54W-WGQM vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-56847 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-56847 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-QRQ2-C54W-WGQM vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-56850 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-HW7R-7V27-7388 vulnerabilities

Vulnerabilities for packages: nodejs...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Node.js st module Directory Traversal

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...

Photon OS 5.0: Nodejs PHSA-2026-5.0-92-0942

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0942. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-70601

CVE-2026-70601 affects Electron, a framework for building cross‑platform desktop apps with JavaScript/HTML/CSS. The issue arises when apps expose Promise‑returning functions to web content via contextBridge, allowing a context isolation bypass. In environments where a sandbox is absent or nodeInt...

Malicious code in devplatform-spa-plugin-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78 On require of the package, index.js loads vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct...

Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

Oracle Linux 10 : nodejs24 (ELSA-2026-48034)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48034 advisory. - Fix CVE-2026-13149 brace-expansion Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...