https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:04:51.387132+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:2848 ALSA-2020:2848 — Important: nodejs:10 security update 2026-10-03T05:04:51.624046+00:00

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)

* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2020-04460 bdu:2020-04460 2026-10-03T05:04:51.624171+00:00 bdu:2020-04460 https://cve.radiocsirt.org/vuln/bell-cve-2020-8174 Withdrawn: BELL-CVE-2020-8174 — CVE-2020-8174 does not affect BellSoft software 2026-10-03T05:04:51.624201+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2020-8174 BIT-node-2020-8174 2026-10-03T05:04:51.624227+00:00

Affected: Bitnami: node

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

 https://cve.radiocsirt.org/vuln/certfr-2020-avi-664 certfr-2020-avi-664 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Elles permettent à un attaquant de provoquer une exé… 2026-10-03T05:04:51.624260+00:00 certfr-2020-avi-664 https://cve.radiocsirt.org/vuln/cleanstart-2026-bd71263 Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-… 2026-10-03T05:04:51.624290+00:00

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/cnvd-2020-36748 cnvd-2020-36748 2026-10-03T05:04:51.624355+00:00 cnvd-2020-36748 https://cve.radiocsirt.org/vuln/euvd-2026-38298 EUVD-2026-38298 2026-10-03T05:04:51.624382+00:00 EUVD-2026-38298 https://cve.radiocsirt.org/vuln/fkie_cve-2020-8174 fkie_cve-2020-8174 2026-10-03T05:04:51.624403+00:00

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-gcvv-7whm-pv7c GHSA-gcvv-7whm-pv7c 2026-10-03T05:04:51.624443+00:00

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

 https://cve.radiocsirt.org/vuln/gsd-2020-8174 gsd-2020-8174 2026-10-03T05:04:51.624472+00:00 gsd-2020-8174 https://cve.radiocsirt.org/vuln/icsa-22-090-02 ICSA-22-090-02 — Hitachi Energy e-mesh EMS 2026-10-03T05:04:51.624493+00:00

A vulnerability exists in a specific Node.js function, which could allow various kinds of memory corruption and cause a denial-of-service condition.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to a Use After Free bug in its TLS implementation. This could cause corruption of memory leading to a denial-of-service condition.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to an error in the HTTP/2 session frame, which is limited to 32 settings by default. An attacker could consume all available CPU resources causing a denial-of-service condition.CVE-2020-11080 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is affected by too many connection attempts with an unknown protocol. This could allow an attacker to cause a denial-of-service condition.CVE-2021-22883 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

 https://cve.radiocsirt.org/vuln/msrc_cve-2020-8174 msrc_CVE-2020-8174 — napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0 12.18.0 and < 14.4.0. 2026-10-03T05:04:51.624542+00:00 msrc_CVE-2020-8174 https://cve.radiocsirt.org/vuln/opensuse-su-2020:0802-1 openSUSE-SU-2020:0802-1 — Security update for nodejs8 2026-10-03T05:04:51.624568+00:00

Security update for nodejs8

 https://cve.radiocsirt.org/vuln/rhsa-2020:2847 RHSA-2020:2847 — Red Hat Security Advisory: nodejs:12 security update 2026-10-03T05:04:51.624598+00:00

nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload nodejs: TLS session reuse can lead to hostname verification bypass nodejs: memory corruption in napi_get_value_string_* functions nghttp2: overly large SETTINGS frames can lead to DoS

 https://cve.radiocsirt.org/vuln/suse-su-2020:1568-1 SUSE-SU-2020:1568-1 — Security update for nodejs10 2026-10-03T05:04:51.624648+00:00

Security update for nodejs10

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-8174 UBUNTU-CVE-2020-8174 2026-10-03T05:04:51.624686+00:00

Affected: Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:20.04:LTS: nodejs

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1374 WID-SEC-W-2023-1374 — Node.js: Mehrere Schwachstellen 2026-10-03T05:04:51.624729+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen oder seine Privilegien zu erweitern.