https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:37:37.569210+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:35841 ALSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update 2026-10-03T06:37:37.981356+00:00

Affected: AlmaLinux:10: nodejs24, AlmaLinux:10: nodejs24-devel, AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-full-i18n, AlmaLinux:10: nodejs24-libs, AlmaLinux:10: nodejs24-npm

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()…

 https://cve.radiocsirt.org/vuln/bell-cve-2026-48933 BELL-CVE-2026-48933 2026-10-03T06:37:37.981455+00:00

Affected: Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs

 https://cve.radiocsirt.org/vuln/bit-node-2026-48933 BIT-node-2026-48933 2026-10-03T06:37:37.981484+00:00

Affected: Bitnami: node

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0786 certfr-2026-avi-0786 — De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-03T06:37:37.981505+00:00 certfr-2026-avi-0786 https://cve.radiocsirt.org/vuln/euvd-2026-349693 EUVD-2026-349693 2026-10-03T06:37:37.981521+00:00 EUVD-2026-349693 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48933 fkie_cve-2026-48933 2026-10-03T06:37:37.981532+00:00

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/ghsa-pvpp-9x2p-fxg3 GHSA-pvpp-9x2p-fxg3 2026-10-03T06:37:37.981554+00:00

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11110-1 openSUSE-SU-2026:11110-1 — nodejs26-26.3.1-1.1 on GA media 2026-10-03T06:37:37.981569+00:00

nodejs26-26.3.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:28727 RHSA-2026:28727 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T06:37:37.981605+00:00

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()

 https://cve.radiocsirt.org/vuln/rlsa-2026:35841 RLSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update 2026-10-03T06:37:37.981626+00:00

Affected: Rocky Linux:10: nodejs24

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933…

 https://cve.radiocsirt.org/vuln/suse-su-2026:22368-1 SUSE-SU-2026:22368-1 — Security update for nodejs22 2026-10-03T06:37:37.981667+00:00

Security update for nodejs22

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48933 UBUNTU-CVE-2026-48933 2026-10-03T06:37:37.981697+00:00

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2004 WID-SEC-W-2026-2004 — Node.js: Mehrere Schwachstellen 2026-10-03T06:37:37.981725+00:00

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.