Most recent entries from all

ALSA-2026:1842 — Important: nodejs24 security update

Affected: AlmaLinux:10: nodejs24-docs, AlmaLinux:10: nodejs24-npm

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-00544

BELL-CVE-2025-55132

Affected: Alpaquita:23: nodejs, Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:23: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs

BIT-node-2025-55132

Affected: Bitnami: node

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

certfr-2026-avi-0039 — De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de prov…

certfr-2026-avi-0039

CLEANSTART-2026-OM37971 — flaw in Node

Affected: CleanStart: apache-superset

Security vulnerability affects the apache-superset package. A flaw in Node.

EUVD-2026-266234

fkie_cve-2025-55132

GHSA-pm9v-wcw9-xgpv

OESA-2026-1218 — nodejs security update

Affected: openEuler:24.03-LTS-SP2: nodejs

Node.js is a platform built on Chrome&apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)

Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include: 1. **CVE-2025-55131 (High)**: A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted using the `vm` module with the `timeout` option. Buffers allocated with `Buffer.alloc` and other TypedArray instances like `Uint8Array` may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption. 2. **CVE-2025-55130 (High)**: A flaw in Node.js's Permissions model allows a…

openSUSE-SU-2026:10062-1 — corepack24-24.13.0-1.1 on GA media

corepack24-24.13.0-1.1 on GA media

RHSA-2026:6402 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

nodejs: Nodejs file permissions bypass nodejs: Nodejs uninitialized memory exposure nodejs: Nodejs filesystem permissions bypass nodejs: Nodejs memory leak nodejs: Nodejs denial of service nodejs: Nodejs denial of service nodejs: Nodejs network segmentation bypass nodejs: Nodejs denial of service nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions

SUSE-SU-2026:0295-1 — Security update for nodejs22

Security update for nodejs22

UBUNTU-CVE-2025-55132

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.10: nodejs, Ubuntu:26.04:LTS: nodejs

WID-SEC-W-2026-0098 — Node.js: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.