https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:26:03.753981+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:61376 ALSA-2026:61376 — Important: nodejs22 security update 2026-10-04T07:26:04.346028+00:00

Affected: AlmaLinux:10: nodejs, AlmaLinux:10: nodejs-devel, AlmaLinux:10: nodejs-docs, AlmaLinux:10: nodejs-full-i18n, AlmaLinux:10: nodejs-libs, AlmaLinux:10: nodejs-npm

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2026-58043 BELL-CVE-2026-58043 2026-10-04T07:26:04.346114+00:00

Affected: Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs

 https://cve.radiocsirt.org/vuln/bit-node-2026-58043 BIT-node-2026-58043 2026-10-04T07:26:04.346143+00:00

Affected: Bitnami: node

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0947 certfr-2026-avi-0947 — De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-04T07:26:04.346165+00:00 certfr-2026-avi-0947 https://cve.radiocsirt.org/vuln/cleanstart-2026-rx91523 CLEANSTART-2026-RX91523 — Security fix for CVE-2026-58043 applied in: nodejs 26.5.0-r0 2026-10-04T07:26:04.346183+00:00

Affected: CleanStart: nodejs

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-343158 EUVD-2026-343158 2026-10-04T07:26:04.346209+00:00 EUVD-2026-343158 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58043 fkie_cve-2026-58043 2026-10-04T07:26:04.346221+00:00

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

 https://cve.radiocsirt.org/vuln/ghsa-qrq2-c54w-wgqm GHSA-qrq2-c54w-wgqm 2026-10-04T07:26:04.346243+00:00

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.

This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-58043 msrc_CVE-2026-58043 — A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.… 2026-10-04T07:26:04.346260+00:00 msrc_CVE-2026-58043 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11439-1 openSUSE-SU-2026:11439-1 — corepack24-24.18.1-1.1 on GA media 2026-10-04T07:26:04.346278+00:00

corepack24-24.18.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:48273 RHSA-2026:48273 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-04T07:26:04.346300+00:00

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing undici: undici: HTTP header injection via unvalidated blob-like body type property undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici: Undici: Cookie attribute injection allows bypassing security protections nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw nodejs: Information disclosure due to improper permission enforcement nodejs: HTTPS Agent TLS session reuse skips hostname verification nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

 https://cve.radiocsirt.org/vuln/rlsa-2026:61376 RLSA-2026:61376 — Important: nodejs22 security update 2026-10-04T07:26:04.346333+00:00

Affected: Rocky Linux:10: nodejs22

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)

* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:23130-1 SUSE-SU-2026:23130-1 — Security update for nodejs22 2026-10-04T07:26:04.346359+00:00

Security update for nodejs22

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-58043 UBUNTU-CVE-2026-58043 2026-10-04T07:26:04.346380+00:00

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:26.04:LTS: nodejs

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2585 WID-SEC-W-2026-2585 — Node.js: Mehrere Schwachstellen 2026-10-04T07:26:04.346408+00:00

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.