MiracleLinux 8 : nodejs:22 (AXSA:2026-1464:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1464:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CLSA-2026-1785814744 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2...

CLSA-2026-1785030424 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2...

CLSA-2026-1784769551 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 9 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.1...

CLSA-2026-1784769547 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1...

CLSA-2026-1777941826 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 10 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.1...

CLSA-2026-1776213242 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1...

CLSA-2026-1768262917 TuxCare security update for 39 packages (22 CVEs)

TuxCare rebuilt 39 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1...

K000162755: Node.js CVE-2026-48937

Security Advisory Description A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24. CVE-2026-48937 Impact There is no impact; F5 products are not affected b...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

ALPINE-CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-58042

Affected software: Node.js 22.x, 24.x, and 26.x. Vulnerability: dns.resolveAny() can cause the Node.js process to abort when a DNS response contains more than 256 A records. Repeated triggering may lead to a denial of service. Root cause/impact: The flaw in dns.resolveAny() leads to process termi...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

EUVD-2026-52562

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...