ROOT-APP-NPM-CVE-2026-9496 CVE-2026-9496 in pacote - Patched by Root

Root has patched CVE-2026-9496 in the pacote package for Root:npm. Multiple fixed versions available...

CLSA-2026-1792493763 TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 12.0.3-tuxcare.1...

CLSA-2026-1792475534 TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 12.0.2-tuxcare.1...

CLEANSTART-2026-AI21372 Versions of the package pacote from 11

CVE-2026-9496 affects multiple packages. Versions of the package pacote from 11. See references for individual vulnerability details...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2026:1791840472)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791840472 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacke...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacke...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 10 : nodejs22 (RHSA-2026:84703)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84703 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

RHEL 9 : nodejs:22 (RHSA-2026:84589)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84589 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CLSA-2026-1792163599 TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.0.3-tuxcare.1...

PT-2026-124801

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.0.3-tuxcare.1...

CLEANSTART-2026-HY69996 Versions of the package pacote from 11

Security vulnerability affects the renovate package. Versions of the package pacote from 11...

CLSA-2026-1791840472 nodejs: Fix of CVE-2026-9496

CVE-2026-9496: strip the committish in addGitSha of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU...

nodejs:22 security update

nodejs 1:22.23.2-2 - Patches pacote CVE and updates undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259888 RHEL-255268 nodejs-nodemon 3.1.14-2 - Rebase npm/brace-expansion to 5.0.9 Fixes: CVE-2026-69152 Resolves: RHEL-223760 nodejs-packaging 2021.06-4 - Exclude ix86 arches fro...

nodejs:22 security update

An update is available for module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, nodejs, module.nodejs-nodemon, module.nodejs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:76750 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...