Malicious Package

Overview hermes-celeste-react-bootstrap-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

CVE-2026-55968

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.6.hum1 noarch nodejs24-devel-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.6.hum1 noarch...

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

NPM: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock vulnerability discovered by ? in WordPress Npm sm-crypto versions 0.5.0...

GHSA-VH45-F885-3848 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.1-2.3.hum1 noarch nodejs22-devel-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.1-2.3.hum1 noarch...

Uncontrolled Recursion

Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An...

AZL-94535 CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-64806

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

RHSA-2026:41947 Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Bulletin has no description...

Oracle Linux 8 : nodejs:24 (ELSA-2026-39868)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39868 advisory. nodejs 1:24.18.0-1 - Update to version 24.18.0 Resolves: RHEL-168744 nodejs-nodemon 3.0.3-1 - Initial import into nodejs:24 module nodejs-packaging...

Oracle Linux 8 : nodejs:22 (ELSA-2026-41947)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41947 advisory. - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

EUVD-2026-41125

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.260.0...

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

Fedora 45 : nodejs22 (2026-3298e71891)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3298e71891 advisory. Automatic update for nodejs22-22.23.1-2.fc45. Changelog Mon Jul 20 2026 tjuhasz - 1:22.23.1-2 - CVE-2026-42338 ip-address HTML escaping fix rhbz2487625 Mon J...

AlmaLinux 8 : nodejs:22 (ALSA-2026:41947)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...