{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-105481: http: check an idle keep-alive socket for unread bytes\n before handing it to a request, so a response written before the request\n was sent cannot be parsed as that request's response\n- CVE-2026-105482: dns: reject names containing NUL bytes in the resolve*()\n and reverse() paths instead of handing a truncated name to c-ares\n (Resolver#setLocalAddress does not exist on 10.x, so that half of the\n upstream change is not applicable here)\n- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes in\n lookup() and net.connect(); carried as a prerequisite of CVE-2026-105482,\n which calls the validateStringWithoutNullBytes() helper it adds\n- CVE-2026-48618: tls: normalize the peer hostname with domainToASCII()\n before matching it against the certificate's DNS names, so IDNA label\n separators such as U+3002 cannot defeat the wildcard-depth rule; carried\n as a prerequisite of CVE-2026-106069 and CVE-2026-105483, which fix\n bypasses of this normalization\n- CVE-2026-106069, CVE-2026-106072: tls: reject hosts that net.isIP() does\n not accept but that normalize to an IPv4 address, such as 0127.0.0.1,\n 0x7f.0.0.1 or 2130706433, so a certificate DNS SAN can no longer\n authenticate an IP endpoint\n- CVE-2026-105483: tls: cover the same bypass reached through IDNA mapping\n (fullwidth digits, ideographic full stop); the code fix is the\n CVE-2026-106069 patch, so this is a test-only change as it is upstream\n- CVE-2026-111497: deps: brotli: detect and report an invalid block switch\n earlier, fixing an out-of-bounds write in the decoder, and expose\n BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH\n- Not applicable to 10.24.1: CVE-2026-106070 (ZipFile), CVE-2026-106071 and\n CVE-2026-106073 (permission model), CVE-2026-106074 (startup snapshots/SEA)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el8/advisories/2026/clsa-2026_1792756432.json" } ], "tracking": { "current_release_date": "2026-10-23T11:55:18Z", "generator": { "date": "2026-10-23T11:55:18Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792756432", "initial_release_date": "2026-10-23T11:55:18Z", "revision_history": [ { "date": "2026-10-23T11:55:18Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-nodejs10-nodejs: Fix of 8 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "product": { "name": "alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "product_id": "alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs10-nodejs-docs@10.24.1-7.el8?arch=noarch&os_name=centos&os_version=8" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "product": { "name": "alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "product_id": "alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs10-nodejs@10.24.1-7.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64", "product": { "name": "alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64", "product_id": "alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs10-npm@6.14.12-10.24.1.7.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "product": { "name": "alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "product_id": "alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs10-nodejs-devel@10.24.1-7.el8?arch=x86_64&os_name=centos&os_version=8" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch" }, "product_reference": "alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64" }, "product_reference": "alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" }, "product_reference": "alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64" }, "product_reference": "alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "relates_to_product_reference": "CentOS-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-111497", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-111497" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105482", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105482" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105483", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105483" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-105481", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-105481" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-106072", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-106072" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-48930", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-48930" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-106069", "notes": [ { "category": "description", "text": "Hand-built record: no CVE database had this CVE at ingestion.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-106069" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-48618", "cwe": { "id": "CWE-176", "name": "Improper Handling of Unicode Encoding" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:28727", "url": "https://access.redhat.com/errata/RHSA-2026:28727" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:29012", "url": "https://access.redhat.com/errata/RHSA-2026:29012" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30172", "url": "https://access.redhat.com/errata/RHSA-2026:30172" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35841", "url": "https://access.redhat.com/errata/RHSA-2026:35841" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35842", "url": "https://access.redhat.com/errata/RHSA-2026:35842" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35891", "url": "https://access.redhat.com/errata/RHSA-2026:35891" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35892", "url": "https://access.redhat.com/errata/RHSA-2026:35892" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39246", "url": "https://access.redhat.com/errata/RHSA-2026:39246" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39868", "url": "https://access.redhat.com/errata/RHSA-2026:39868" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41947", "url": "https://access.redhat.com/errata/RHSA-2026:41947" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52399", "url": "https://access.redhat.com/errata/RHSA-2026:52399" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7378", "url": "https://access.redhat.com/errata/RHSA-2026:7378" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9455", "url": "https://access.redhat.com/errata/RHSA-2026:9455" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48618", "url": "https://access.redhat.com/security/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-23T11:53:54.325650Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432", "product_ids": [ "CentOS-8:alt-nodejs10-nodejs-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-devel-0:10.24.1-7.el8.x86_64", "CentOS-8:alt-nodejs10-nodejs-docs-0:10.24.1-7.el8.noarch", "CentOS-8:alt-nodejs10-npm-0:6.14.12-10.24.1.7.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1792756432" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }