nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

RHEL 8 : nodejs:22 (RHSA-2026:75870)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75870 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2141)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2141 advisory. Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec...

Medium: nodejs24

Issue Overview: Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logi...

GHSA-W4PP-8PJF-RMXW pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing...

DEBIAN-CVE-2026-9496

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...

EUVD-2026-31793

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing...

PT-2026-43191

Name of the Vulnerable Software and Affected Versions pacote versions 11.2.7 and later Description A Regular Expression Denial of Service ReDoS exists in the addGitSha function. An attacker can cause excessive CPU consumption, potentially stalling or crashing the process, by providing a specially...

CVE-2026-9496: Inefficient Regular Expression Complexity

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...