5459 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-67550
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject bu...
RockyLinux 10 : nodejs22 (RLSA-2026:48033)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...
SUSE CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...
SUSE CVE-2026-58039
A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...
SUSE CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...
RHSA-2026:48034 Red Hat Security Advisory: nodejs24 security update
Bulletin has no description...
RHSA-2026:48032 Red Hat Security Advisory: nodejs-nodemon security update
Bulletin has no description...
RHSA-2026:48033 Red Hat Security Advisory: nodejs22 security update
Bulletin has no description...
CLEANSTART-2026-OL35355 Security fixes in nodejs 20.15.1-r0
Package nodejs version 20.15.1-r0 fixes 3 vulnerabilities: CVE-2024-22018, CVE-2024-22020, CVE-2024-36137...
CLEANSTART-2026-JG51034 Security fixes in nodejs 10.15.3-r0
Package nodejs version 10.15.3-r0 fixes 1 vulnerabilities: CVE-2019-5737...
CLEANSTART-2026-OY23863 Security fixes in nodejs 14.15.4-r0
Package nodejs version 14.15.4-r0 fixes 2 vulnerabilities: CVE-2020-8265, CVE-2020-8287...
CLEANSTART-2026-LB88869 Security fixes in nodejs 6.11.5-r0
Package nodejs version 6.11.5-r0 fixes 1 vulnerabilities: CVE-2017-14919...
CLEANSTART-2026-SO42358 Security fixes in nodejs 14.16.1-r0
Package nodejs version 14.16.1-r0 fixes 1 vulnerabilities: CVE-2020-7774...
CLEANSTART-2026-FI53720 Security fixes in nodejs 18.18.2-r0
Package nodejs version 18.18.2-r0 fixes 3 vulnerabilities: CVE-2023-45143, CVE-2023-38552, CVE-2023-39333...
CLEANSTART-2026-YC26547 Security fixes in nodejs 8.9.3-r0
Package nodejs version 8.9.3-r0 fixes 2 vulnerabilities: CVE-2017-15896, CVE-2017-15897...