https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:53:55.986959+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:1582 ALSA-2023:1582 — Moderate: nodejs:16 security, bug fix, and enhancement update 2026-10-02T14:53:56.018449+00:00

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

* glob-parent: Regular Expression Denial of Service (CVE-2021-35065) * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919) * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-08734 bdu:2024-08734 2026-10-02T14:53:56.018526+00:00 bdu:2024-08734 https://cve.radiocsirt.org/vuln/bell-cve-2023-23936 Withdrawn: BELL-CVE-2023-23936 — CVE-2023-23936 does not affect BellSoft software 2026-10-02T14:53:56.018544+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2023-23936 BIT-node-2023-23936 — CRLF Injection in Nodejs ‘undici’ via host 2026-10-02T14:53:56.018560+00:00

Affected: Bitnami: node

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0337 certfr-2023-avi-0337 — De multiples vulnérabilités ont été découvertes dans les produits <span class="textit">IBM</span>. Elles permettent à u… 2026-10-02T14:53:56.018581+00:00 certfr-2023-avi-0337 https://cve.radiocsirt.org/vuln/cleanstart-2026-bd71263 Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-… 2026-10-02T14:53:56.018596+00:00

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-221556 EUVD-2026-221556 2026-10-02T14:53:56.018620+00:00 EUVD-2026-221556 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23936 fkie_cve-2023-23936 2026-10-02T14:53:56.018631+00:00

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

 https://cve.radiocsirt.org/vuln/fsa-202302 FSA-202302 — Festo: Several vulnerabilities in FactoryViews 2026-10-02T14:53:56.018652+00:00

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

 https://cve.radiocsirt.org/vuln/ghsa-5r9g-qh6m-jxff GHSA-5r9g-qh6m-jxff — CRLF Injection in Nodejs ‘undici’ via host 2026-10-02T14:53:56.018760+00:00

Affected: npm: undici

### Impact

undici library does not protect `host` HTTP header from CRLF injection vulnerabilities.

### Patches

This issue was patched in Undici v5.19.1.

### Workarounds

Sanitize the `headers.host` string before passing to undici.

### References

Reported at https://hackerone.com/reports/1820955.

### Credits

Thank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-23936 gsd-2023-23936 2026-10-02T14:53:56.018786+00:00 gsd-2023-23936 https://cve.radiocsirt.org/vuln/msrc_cve-2023-23936 msrc_CVE-2023-23936 — CRLF Injection in Nodejs ‘undici’ via host 2026-10-02T14:53:56.018797+00:00 msrc_CVE-2023-23936 https://cve.radiocsirt.org/vuln/rhsa-2023:1582 RHSA-2023:1582 — Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update 2026-10-02T14:53:56.018811+00:00

glob-parent: Regular Expression Denial of Service c-ares: buffer overflow in config_sortlist() due to missing string length check http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability Node.js: Permissions policies can be bypassed via process.mainModule Node.js: OpenSSL error handling issues in nodejs crypto library Node.js: insecure loading of ICU data through ICU_DATA environment variable Node.js: Fetch API did not protect against CRLF injection in host headers Node.js: Regular Expression Denial of Service in Headers fetch API

 https://cve.radiocsirt.org/vuln/rhsa-2023:5533 RHSA-2023:5533 — Red Hat Security Advisory: nodejs security, bug fix, and enhancement update 2026-10-02T14:53:56.018837+00:00

c-ares: buffer overflow in config_sortlist() due to missing string length check http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability Node.js: insecure loading of ICU data through ICU_DATA environment variable Node.js: Fetch API did not protect against CRLF injection in host headers Node.js: Regular Expression Denial of Service in Headers fetch API nodejs: mainModule.proto bypass experimental policy mechanism nodejs: process interuption due to invalid Public Key information in x509 certificates nodejs: HTTP Request Smuggling via Empty headers separated by CR nodejs: DiffieHellman do not generate keys after setting a private key nodejs: Permissions policies can be bypassed via Module._load nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() nodejs: Permissions policies can be bypassed via process.binding

 https://cve.radiocsirt.org/vuln/suse-su-2023:0609-1 SUSE-SU-2023:0609-1 — Security update for nodejs16 2026-10-02T14:53:56.018869+00:00

Security update for nodejs16

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0414 WID-SEC-W-2023-0414 — Node.js: Mehrere Schwachstellen 2026-10-02T14:53:56.018884+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.