Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RockyLinux 9 : nodejs:22 (RLSA-2026:47058)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

PT-2026-67576

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when...

Oracle Linux 10 : nodejs22 (ELSA-2026-35842)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35842 advisory. - CVE-2026-42338 ip-address HTML escaping fix. Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

CVE-2026-58039

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

CVE-2026-58039

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

RockyLinux 10 : nodejs22 (RLSA-2026:48033)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...

RHSA-2026:48033 Red Hat Security Advisory: nodejs22 security update

Bulletin has no description...

CLEANSTART-2026-CL42205 Security fixes in kyverno-fips 1.13.6-r9

Package kyverno-fips version 1.13.6-r9 fixes 22 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2026-25679, CVE-2025-61730...

CLEANSTART-2026-ZN75891 Security fixes in aws-flb-kinesis 1.10.3-r0

Package aws-flb-kinesis version 1.10.3-r0 fixes 22 vulnerabilities: ghsa-4f99-4q7p-p3gh, CVE-2025-65637, ghsa-8r3f-844c-mc37, CVE-2024-24786, CVE-2025-68121...

CLEANSTART-2026-YO06374 Security fixes in cilium 1.18.9-r0

Package cilium version 1.18.9-r0 fixes 22 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-27143, CVE-2026-27144, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-YQ65927 Security fixes in cilium 1.19.3-r0

Package cilium version 1.19.3-r0 fixes 22 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-27143, CVE-2026-27144, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-RZ36238 Security fixes in azure-functions-node 4.1052.200-r0

Package azure-functions-node version 4.1052.200-r0 fixes 22 vulnerabilities: CVE-2026-41907, CVE-2026-48068, CVE-2026-48069, CVE-2024-37168, CVE-2024-4068...

CLEANSTART-2026-XZ70662 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r4 fixes 22 vulnerabilities: ghsa-v23v-6jw2-98fq, ghsa-459x-q9hg-4gpq, ghsa-4qg8-fj49-pxjh, ghsa-6m8w-jc87-6cr7, ghsa-f83f-xpx7-ffpw...

CLEANSTART-2026-RH34927 Security fixes in cosign 1.12.1-r0

Package cosign version 1.12.1-r0 fixes 1 vulnerabilities: CVE-2022-36056...

CLEANSTART-2026-HA12816 Security fixes in velero 1.17.2-r3

Package velero version 1.17.2-r3 fixes 22 vulnerabilities: CVE-2026-42504, CVE-2026-27145, CVE-2026-42507, CVE-2026-39827, CVE-2026-39828...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

ALPINE-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

UBUNTU-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...