5462 matches found
CVE-2026-58039
A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...
nodejs:24 security update
nodejs 1:24.18.0-3 - Fix CVE-2026-59873, CVE-2026-59874 node-tar in npm's bundled tar 1:24.18.0-2 - Fix CVE-2026-13149 brace-expansion in npm's bundled brace-expansion 1:24.18.0-1 - Update to version 24.18.0 1:24.14.1-2 - Update bundled nghttp2 to 1.68.1 1:24.14.1-1 - Update to version 24.14.1...
Linux Distros Unpatched Vulnerability : CVE-2026-67550
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject bu...
RockyLinux 10 : nodejs24 (RLSA-2026:48034)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48034 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...
RockyLinux 10 : nodejs22 (RLSA-2026:48033)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...
SUSE CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...
SUSE CVE-2026-58039
A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...
SUSE CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...
RHSA-2026:48034 Red Hat Security Advisory: nodejs24 security update
Bulletin has no description...
RHSA-2026:48033 Red Hat Security Advisory: nodejs22 security update
Bulletin has no description...
RHSA-2026:48032 Red Hat Security Advisory: nodejs-nodemon security update
Bulletin has no description...
CLEANSTART-2026-RE30650 Security fixes in nodejs 18.17.1-r0
Package nodejs version 18.17.1-r0 fixes 3 vulnerabilities: CVE-2023-32002, CVE-2023-32006, CVE-2023-32559...
CLEANSTART-2026-ZC34579 Security fixes in nodejs 16.17.1-r0
Package nodejs version 16.17.1-r0 fixes 5 vulnerabilities: CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-35255, CVE-2022-35256...
CLEANSTART-2026-IV47150 Security fixes in nodejs 14.17.4-r0
Package nodejs version 14.17.4-r0 fixes 1 vulnerabilities: CVE-2021-22930...
CLEANSTART-2026-OL35355 Security fixes in nodejs 20.15.1-r0
Package nodejs version 20.15.1-r0 fixes 3 vulnerabilities: CVE-2024-22018, CVE-2024-22020, CVE-2024-36137...