https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:29:21.134838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:8832 ALSA-2022:8832 — Moderate: nodejs:18 security, bug fix, and enhancement update 2026-10-02T23:29:21.800458+00:00

Affected: AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)

Security Fix(es):

* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2022-06821 bdu:2022-06821 2026-10-02T23:29:21.800553+00:00 bdu:2022-06821 https://cve.radiocsirt.org/vuln/bell-cve-2022-43548 Withdrawn: BELL-CVE-2022-43548 — CVE-2022-43548 does not affect BellSoft software 2026-10-02T23:29:21.800572+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2022-43548 BIT-node-2022-43548 2026-10-02T23:29:21.800587+00:00

Affected: Bitnami: node

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0034 certfr-2023-avi-0034 — De multiples vulnérabilités ont été découvertes dans les produits Oracle. Certaines d'entre elles permettent à un attaq… 2026-10-02T23:29:21.800609+00:00 certfr-2023-avi-0034 https://cve.radiocsirt.org/vuln/cleanstart-2026-bd71263 Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-… 2026-10-02T23:29:21.800625+00:00

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-235825 EUVD-2026-235825 2026-10-02T23:29:21.800650+00:00 EUVD-2026-235825 https://cve.radiocsirt.org/vuln/fkie_cve-2022-43548 fkie_cve-2022-43548 2026-10-02T23:29:21.800661+00:00

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

 https://cve.radiocsirt.org/vuln/fsa-202302 FSA-202302 — Festo: Several vulnerabilities in FactoryViews 2026-10-02T23:29:21.800683+00:00

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

 https://cve.radiocsirt.org/vuln/ghsa-r934-m2c7-26gh GHSA-r934-m2c7-26gh 2026-10-02T23:29:21.800794+00:00

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

 https://cve.radiocsirt.org/vuln/gsd-2022-43548 gsd-2022-43548 2026-10-02T23:29:21.800810+00:00 gsd-2022-43548 https://cve.radiocsirt.org/vuln/msrc_cve-2022-43548 msrc_CVE-2022-43548 — A OS Command Injection vulnerability exists in Node.js versions <14.21.1 <16.18.1 <18.12.1 <19.0.1 due to an insufficie… 2026-10-02T23:29:21.800821+00:00 msrc_CVE-2022-43548 https://cve.radiocsirt.org/vuln/oesa-2022-2114 OESA-2022-2114 — nodejs security update 2026-10-02T23:29:21.800875+00:00

Affected: openEuler:20.03-LTS-SP1: nodejs, openEuler:20.03-LTS-SP3: nodejs, openEuler:22.03-LTS: nodejs

Node.js is a platform built on Chrome&apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.(CVE-2022-43548)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12488-1 openSUSE-SU-2024:12488-1 — corepack18-18.12.1-1.1 on GA media 2026-10-02T23:29:21.800902+00:00

corepack18-18.12.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:0612 RHSA-2023:0612 — Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update 2026-10-02T23:29:21.800918+00:00

glob-parent: Regular Expression Denial of Service minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor nodejs-minimatch: ReDoS via the braceExpand function express: "qs" prototype poisoning causes the hang of the node process nodejs: DNS rebinding in inspect via invalid octal IP address

 https://cve.radiocsirt.org/vuln/suse-su-2022:3967-1 SUSE-SU-2022:3967-1 — Security update for nodejs16 2026-10-02T23:29:21.800943+00:00

Security update for nodejs16

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-43548 UBUNTU-CVE-2022-43548 2026-10-02T23:29:21.800959+00:00

Affected: Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:20.04:LTS: nodejs, Ubuntu:22.04:LTS: nodejs

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1960 WID-SEC-W-2022-1960 — Node.js: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-02T23:29:21.800981+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen.