AZL-105096 CVE-2026-102276 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

AZL-105092 CVE-2026-102278 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

AZL-105089 CVE-2026-102277 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...

h5p-nodejs-library Cross Site Scripting

A persistent cross site scripting vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions prior to 9.3.3. The vulnerability allows users to inject malicious JavaScript code in text fields. This code is then executed in victims' browsers when viewing...

[SECURITY] [DSA 6517-1] nodejs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6517-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 26, 2026 https://www.debian.org/security/faq -...

Debian dsa-6517 : libnode-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6517 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6517-1 [email protected] https://www.debian.org/securit...

H5P Nodejs Library 10.0.4 Cross Site Scripting

Lumi Education h5p-nodejs-library versions through 10.0.4 contain a cross site scripting vulnerability due to insufficient validation of files contained in uploaded H5P content. An attacker can upload content containing malicious JavaScript that executes in another user's browser when the affecte...

AZL-103451 CVE-2026-93750 affecting package nodejs-nodemon 2.0.3-5

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

AZL-103448 CVE-2026-93748 affecting package nodejs-nodemon 2.0.3-5

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

Memory Allocation with Excessive Size Value

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's...

AZL-103445 CVE-2026-93687 affecting package nodejs-nodemon 2.0.3-5

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

CLEANSTART-2026-TE76702 Security fix for CVE-2024-37372 applied in: nodejs 6.11.1-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-FU20845 Security fix for CVE-2024-36138 applied in: nodejs 6.11.1-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DF66102 Security fix for CVE-2022-32212 applied in: nodejs 6.11.1-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XA75474 Security fix for CVE-2021-43803 applied in: nodejs 6.11.1-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VM93629 Security fix for CVE-2017-1000381 applied in: nodejs 6.11.1-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JL30943 Security fix for CVE-2017-14919 applied in: nodejs 6.11.5-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BR75725 Security fix for CVE-2017-15897 applied in: nodejs 8.9.3-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZO30257 Security fix for CVE-2017-15896 applied in: nodejs 8.9.3-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EN95904 Security fix for CVE-2018-7160 applied in: nodejs 8.11.0-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...