RockyLinux 9 : nodejs:24 (RLSA-2026:47057)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47057 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

AlmaLinux 8 : perl:5.32 (ALSA-2026:48225)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48225 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding description...

Debian dla-4712 : node-tar - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4712 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4712-1 [email protected]...

[SECURITY] [DLA 4712-1] node-tar security update

Debian LTS Advisory DLA-4712-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert August 01, 2026 https://wiki.debian.org/LTS Package : node-tar Version : 6.1.13+cs7.0.5-1+deb12u1 CVE ID : CVE-2024-28863 CVE-2026-23745 CVE-2026-26960 CVE-2026-29786 Multiple...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

Oracle Linux 9 : nodejs:24 (ELSA-2026-47057)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47057 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar in npm's bundled tar - Fix CVE-2026-13149 brace-expansion in npm's bundled brace-expansion Tenable has...

Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled...

nodejs22 security update

An update is available for nodejs22. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime \ for easily...

nodejs24 security update

An update is available for nodejs24. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime for easily...

RLSA-2026:48033 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

RLSA-2026:48034 Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

SUSE CVE-2026-9538

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. readtar reads each entry's payload with $handle-read$$data, $block, where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that...

RockyLinux 10 : nodejs24 (RLSA-2026:48034)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48034 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...

RockyLinux 10 : nodejs22 (RLSA-2026:48033)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...

Oracle Linux 9 : vim (ELSA-2026-47982)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47982 advisory. - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in...

SUSE CVE-2026-55078

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no...

SUSE CVE-2026-59873

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk spac...

SUSE CVE-2026-59874

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...

SUSE CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAllnameInArchive, "", "/", which turns a POSIX filename such as ....\evil.sh into the...