SUSE-SU-2026:3520-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

Photon OS 5.0: Nodejs PHSA-2026-5.0-92-0942

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0942. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

AlmaLinux 9 : nodejs:22 (ALSA-2026:47058)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

AlmaLinux 9 : nodejs:24 (ALSA-2026:47057)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47057 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

MAL-2026-13378 Malicious code in npm-dc-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...

CVE-2026-70601

CVE-2026-70601 affects Electron, a framework for building cross‑platform desktop apps with JavaScript/HTML/CSS. The issue arises when apps expose Promise‑returning functions to web content via contextBridge, allowing a context isolation bypass. In environments where a sandbox is absent or nodeInt...

Malicious code in eacq-acq-menu-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru'...

Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

Malicious code in devplatform-spa-plugin-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78 On require of the package, index.js loads vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct...

Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...

Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

MAL-2026-12355 Malicious code in com.db.dbk.ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c74649b28994f970d4972ffb8708378b355186eb729bf2e4c45d6acd16346e5d [email protected] is a version-inflated package published to the public npm registry under a scope that resembles an internal namespace. Its...

Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

MAL-2026-12377 Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

Directory Traversal

Overview org.webjars.npm:art-template is a simple and superfast templating engine that optimizes template rendering speed by scope pre-declared technique, hence achieving runtime performance which is close to the limits of JavaScript. At the same time, it supports both NodeJS and browser. Affecte...

Photon OS 5.0: Nodejs PHSA-2026-5.0-91-0895

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0895. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nodejs PHSA-2023-5.0-91-0011

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0011. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Important Photon OS Security Update - PHSA-2026-5.0-92-0942

Updates of 'iniparser', 'nodejs', 'rubygem-msgpack' packages of Photon OS have been released...

Photon OS 5.0: Nodejs PHSA-2023-5.0-91-0082

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0082. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...