https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:13:54.085530+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:0579 ALSA-2020:0579 — Important: nodejs:10 security update 2026-10-02T20:13:54.203961+00:00

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

* npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2019-04690 bdu:2019-04690 2026-10-02T20:13:54.204037+00:00 bdu:2019-04690 https://cve.radiocsirt.org/vuln/brew-node-cve-2019-16776 BREW-node-CVE-2019-16776 — npm symlink reference outside of node_modules 2026-10-02T20:13:54.204054+00:00

Affected: Homebrew: node

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

## Recommendation

Upgrade to version 6.13.3 or later.

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0575 certfr-2024-avi-0575 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent… 2026-10-02T20:13:54.204086+00:00 certfr-2024-avi-0575 https://cve.radiocsirt.org/vuln/cnvd-2019-45389 cnvd-2019-45389 2026-10-02T20:13:54.204103+00:00 cnvd-2019-45389 https://cve.radiocsirt.org/vuln/euvd-2026-57957 EUVD-2026-57957 2026-10-02T20:13:54.204115+00:00 EUVD-2026-57957 https://cve.radiocsirt.org/vuln/fkie_cve-2019-16776 fkie_cve-2019-16776 2026-10-02T20:13:54.204125+00:00

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

 https://cve.radiocsirt.org/vuln/ghsa-x8qc-rrcw-4r46 GHSA-x8qc-rrcw-4r46 — npm symlink reference outside of node_modules 2026-10-02T20:13:54.204149+00:00

Affected: npm: npm

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

## Recommendation

Upgrade to version 6.13.3 or later.

 https://cve.radiocsirt.org/vuln/gsd-2019-16776 gsd-2019-16776 2026-10-02T20:13:54.204180+00:00 gsd-2019-16776 https://cve.radiocsirt.org/vuln/opensuse-su-2020:0059-1 openSUSE-SU-2020:0059-1 — Security update for nodejs8 2026-10-02T20:13:54.204205+00:00

Security update for nodejs8

 https://cve.radiocsirt.org/vuln/rhsa-2020:0573 RHSA-2020:0573 — Red Hat Security Advisory: nodejs:10 security update 2026-10-02T20:13:54.204226+00:00

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string nodejs: HTTP request smuggling using malformed Transfer-Encoding header nodejs: HTTP header values do not have trailing optional whitespace trimmed npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

 https://cve.radiocsirt.org/vuln/suse-su-2020:0043-1 SUSE-SU-2020:0043-1 — Security update for nodejs8 2026-10-02T20:13:54.204251+00:00

Security update for nodejs8

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-16776 UBUNTU-CVE-2019-16776 2026-10-02T20:13:54.204267+00:00

Affected: Ubuntu:14.04:LTS: npm, Ubuntu:Pro:16.04:LTS: npm, Ubuntu:Pro:18.04:LTS: npm, Ubuntu:20.04:LTS: npm, Ubuntu:22.04:LTS: npm, Ubuntu:24.04:LTS: npm, Ubuntu:25.10: npm, Ubuntu:26.04:LTS: npm

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1591 WID-SEC-W-2024-1591 — Juniper JUNOS: Mehrere Schwachstellen 2026-10-02T20:13:54.204297+00:00

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.