Most recent entries from all

ALSA-2026:61376 — Important: nodejs22 security update

Affected: AlmaLinux:10: nodejs, AlmaLinux:10: nodejs-devel, AlmaLinux:10: nodejs-docs, AlmaLinux:10: nodejs-full-i18n, AlmaLinux:10: nodejs-libs, AlmaLinux:10: nodejs-npm

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-56848

Affected: Alpaquita:25: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:25: nodejs, BellSoft Hardened Containers:stream: nodejs

BIT-node-2026-56848

Affected: Bitnami: node

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

certfr-2026-avi-0947 — De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de prov…

certfr-2026-avi-0947

CLEANSTART-2026-AL35198 — Security fix for CVE-2026-56848 applied in: nodejs 26.5.0-r0

Affected: CleanStart: nodejs

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-344178

fkie_cve-2026-56848

GHSA-679w-638g-xf9h

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

openSUSE-SU-2026:11439-1 — corepack24-24.18.1-1.1 on GA media

corepack24-24.18.1-1.1 on GA media

RHSA-2026:62416 — Red Hat Security Advisory: nodejs:22 security update

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

RLSA-2026:61376 — Important: nodejs22 security update

Affected: Rocky Linux:10: nodejs22

Security Fix(es):

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)

* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23130-1 — Security update for nodejs22

Security update for nodejs22

UBUNTU-CVE-2026-56848

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:26.04:LTS: nodejs

WID-SEC-W-2026-2585 — Node.js: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.