https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:34:25 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:1842 <p><strong>Affected:</strong> AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-npm</p> <p>Node.js is a platform built on Chrome&#39;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.</p> <p>Security Fix(es):</p> <p>* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-npm</p> <p>Node.js is a platform built on Chrome&#39;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.</p> <p>Security Fix(es):</p> <p>* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:1842 https://cve.radiocsirt.org/vuln/bdu:2026-00545 bdu:2026-00545 https://cve.radiocsirt.org/vuln/bdu:2026-00545 https://cve.radiocsirt.org/vuln/bell-cve-2025-55130 <p><strong>Affected:</strong> Alpaquita:23: nodejs, Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:23: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs</p> <p><strong>Affected:</strong> Alpaquita:23: nodejs, Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:23: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-55130 https://cve.radiocsirt.org/vuln/bit-node-2025-55130 <p><strong>Affected:</strong> Bitnami: node</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> <p><strong>Affected:</strong> Bitnami: node</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> https://cve.radiocsirt.org/vuln/bit-node-2025-55130 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0039 certfr-2026-avi-0039 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0039 https://cve.radiocsirt.org/vuln/cleanstart-2026-tf09981 <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Security vulnerability affects the apache-superset package. A flaw in Node.</p> <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Security vulnerability affects the apache-superset package. A flaw in Node.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-tf09981 https://cve.radiocsirt.org/vuln/euvd-2026-337738 EUVD-2026-337738 https://cve.radiocsirt.org/vuln/euvd-2026-337738 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55130 <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55130 https://cve.radiocsirt.org/vuln/ghsa-62wc-jj78-f4f6 <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> https://cve.radiocsirt.org/vuln/ghsa-62wc-jj78-f4f6 https://cve.radiocsirt.org/vuln/oesa-2026-1218 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)</p> <p>Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include: 1. **CVE-2025-55131 (High)**: A flaw in Node.js&amp;apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption. 2. **CVE-2025-55130 (High)**: A flaw in Node.js&amp;apos;s Permissions model allows a…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)</p> <p>Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include: 1. **CVE-2025-55131 (High)**: A flaw in Node.js&amp;apos;s buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption. 2. **CVE-2025-55130 (High)**: A flaw in Node.js&amp;apos;s Permissions model allows a…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1218 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10062-1 <p>corepack24-24.13.0-1.1 on GA media</p> <p>corepack24-24.13.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10062-1 https://cve.radiocsirt.org/vuln/rhsa-2026:2768 <p>nodejs: Nodejs file permissions bypass nodejs: Nodejs uninitialized memory exposure nodejs: Nodejs denial of service nodejs: Nodejs denial of service nodejs: Nodejs denial of service</p> <p>nodejs: Nodejs file permissions bypass nodejs: Nodejs uninitialized memory exposure nodejs: Nodejs denial of service nodejs: Nodejs denial of service nodejs: Nodejs denial of service</p> https://cve.radiocsirt.org/vuln/rhsa-2026:2768 https://cve.radiocsirt.org/vuln/suse-su-2026:0295-1 <p>Security update for nodejs22</p> <p>Security update for nodejs22</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0295-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-55130 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs</p> <p>A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-55130 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0098 <p>Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0098