https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:05:24.236967+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:7350 ALSA-2026:7350 — Important: nodejs:24 security update 2026-10-03T16:05:24.340377+00:00

Affected: AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-libs, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm, AlmaLinux:9: v8-13.6-devel

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Nodejs denial of service (CVE-2026-21637) * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesyste…

 https://cve.radiocsirt.org/vuln/bell-cve-2026-21711 Withdrawn: BELL-CVE-2026-21711 — CVE-2026-21711 does not affect BellSoft software 2026-10-03T16:05:24.340467+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2026-21711 BIT-node-2026-21711 2026-10-03T16:05:24.340487+00:00

Affected: Bitnami: node

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

 https://cve.radiocsirt.org/vuln/euvd-2026-278472 EUVD-2026-278472 2026-10-03T16:05:24.340511+00:00 EUVD-2026-278472 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21711 fkie_cve-2026-21711 2026-10-03T16:05:24.340523+00:00

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

 https://cve.radiocsirt.org/vuln/ghsa-vcqx-cqfc-xc2r GHSA-vcqx-cqfc-xc2r 2026-10-03T16:05:24.340547+00:00

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-21711 msrc_CVE-2026-21711 — A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re… 2026-10-03T16:05:24.340567+00:00 msrc_CVE-2026-21711 https://cve.radiocsirt.org/vuln/rhsa-2026:7350 RHSA-2026:7350 — Red Hat Security Advisory: nodejs:24 security update 2026-10-03T16:05:24.340586+00:00

undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: Undici: HTTP header injection and request smuggling vulnerability undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter undici: Undici: Denial of Service due to uncontrolled resource consumption nodejs: Nodejs denial of service Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing Node.js: Node.js: Information disclosure via timing oracle in HMAC verification Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion minimatch: minimatch: Denial of Serv…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21711 UBUNTU-CVE-2026-21711 2026-10-03T16:05:24.340643+00:00

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0843 WID-SEC-W-2026-0843 — Node.js: Mehrere Schwachstellen 2026-10-03T16:05:24.340675+00:00

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.