RLSA-2026:75864 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

Security Bulletin: Due to use of Nodejs Express.js, multiple vulnerabilities affect IBM Cloud Pak System[CVE-2024-43796, CVE-2024-43799, CVE-2024-43800]

Summary Multiple vulnerabilities in Send cross-site scripting XSS within the SendStream.redirect, serve-static built-in and response.redirect found in Node.js Express.js which is used by IBM Cloud Pak System. Vulnerabilities were addressed by IBM Cloud Pak System. Vulnerability Details...

CVE-2026-94545

CVE-2026-94545 Next.js next/og 인증되지 않은 RCE ★ CVE-2026-94545 Next.js next/og SVG 주입을 통한 네이티브 RCE ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 개요 next/og는 JSX를 Satori로 SVG로 렌더링한 다음 그 SVG를 래스터화하여 Open Graph 이미지를 생성합니다. Satori는 사용자가 제공한 텍스트를 이스케이프하지 않고 SVG에...

CVE-2020-8277

CVE-2020-8277 Только для образовательных целей. Быстрый запуск clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you u...

CVE-2024-27983-nodejs-http2

이 저장소는 CVE-2024-27983에 기반하여 취약한 HTTP2 Node.js 서버server-nossl.js를 구축합니다. 이 취약점은 HTTP2 서버의 continuation flood 취약점을 악용합니다. 참고 사항: server.js는 SSL 인증서를 사용하기 때문에 취약하지 않은 것으로 확인되었습니다. server-nossl.js는 continuation flood 공격에 취약합니다. client.js는 HTTP2 서버를 테스트하기 위한 작은 클라이언트 스크립트입니다. exploits/는 HackerOne 보고서를...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL 배칭 별칭 혼동 SQL 인젝션 개요 GraphQL 리졸버가 필드 별칭으로부터 SQL 쿼리를 동적으로 구성합니다. 공격자는 배칭batching과 별칭을 사용하여 허용 목록allow‑list을 우회하고 SQL을 주입할 수 있습니다. 심각도: 치명적 데이터베이스 탈취 Node.js 서버 및 익스플로잇 // vulnerablegraphqlserver.js const express = require'express'; const graphqlHTTP =...

RLSA-2026:75870 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...

nodejs:22 security update

An update is available for nodejs, module.nodejs-nodemon, module.nodejs, nodejs-packaging, module.nodejs-packaging, nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219...

CVE-2026-106104: Inefficient Regular Expression Complexity

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

Linux Distros Unpatched Vulnerability : CVE-2026-102282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...

Linux Distros Unpatched Vulnerability : CVE-2026-102828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...

PT-2026-106822

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.23.3 Description In the Platform.parseSSR function within ui/src/plugins/platform/Platform.js, an unbounded User-Agent request header is passed to the getMatch function. The browser-detection expressions in...

EUVD-2026-89333

simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...

EUVD-2026-88981

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

EUVD-2026-76072

compression vulnerable to Denial of Service via memory leak on premature response close...

CVE-2023-30547

CVE-2023-30547 vm2 — это песочница, которая может выполнять недоверенный код с использованием разрешённых встроенных модулей Node. Существует уязвимость в обработке исключений vm2 для версий до 3.9.16, позволяющая злоумышленникам вызвать неочищенное исключение хоста внутри handleException, что...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...