https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:41:51.800450+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:35841 ALSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update 2026-10-02T19:41:51.987841+00:00

Affected: AlmaLinux:10: nodejs24, AlmaLinux:10: nodejs24-devel, AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-full-i18n, AlmaLinux:10: nodejs24-libs, AlmaLinux:10: nodejs24-npm

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()…

 https://cve.radiocsirt.org/vuln/bell-cve-2026-48934 BELL-CVE-2026-48934 2026-10-02T19:41:51.987944+00:00

Affected: Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs

 https://cve.radiocsirt.org/vuln/bit-node-2026-48934 BIT-node-2026-48934 2026-10-02T19:41:51.987972+00:00

Affected: Bitnami: node

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0786 certfr-2026-avi-0786 — De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-02T19:41:51.987993+00:00 certfr-2026-avi-0786 https://cve.radiocsirt.org/vuln/euvd-2026-330965 EUVD-2026-330965 2026-10-02T19:41:51.988010+00:00 EUVD-2026-330965 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48934 fkie_cve-2026-48934 2026-10-02T19:41:51.988021+00:00

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/ghsa-px9q-xv67-75fr GHSA-px9q-xv67-75fr 2026-10-02T19:41:51.988041+00:00

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11110-1 openSUSE-SU-2026:11110-1 — nodejs26-26.3.1-1.1 on GA media 2026-10-02T19:41:51.988057+00:00

nodejs26-26.3.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:33866 RHSA-2026:33866 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T19:41:51.988092+00:00

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling nodejs: Node.js: Certification validation bypass in TLS host verification nodejs: Node.js: Unauthorized file metadata modification nodejs: Node.js: Local server can be started without network permission via Permission API flaw js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

 https://cve.radiocsirt.org/vuln/rlsa-2026:35841 RLSA-2026:35841 — Important: nodejs24 security, bug fix, and enhancement update 2026-10-02T19:41:51.988124+00:00

Affected: Rocky Linux:10: nodejs24

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933…

 https://cve.radiocsirt.org/vuln/suse-su-2026:22368-1 SUSE-SU-2026:22368-1 — Security update for nodejs22 2026-10-02T19:41:51.988166+00:00

Security update for nodejs22

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48934 UBUNTU-CVE-2026-48934 2026-10-02T19:41:51.988193+00:00

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2004 WID-SEC-W-2026-2004 — Node.js: Mehrere Schwachstellen 2026-10-02T19:41:51.988223+00:00

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.