{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-21637: uncaught exception from SNICallback in loadSNI() crashes\n the TLS server", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/advisories/2026/clsa-2026_1790884160.json" } ], "tracking": { "current_release_date": "2026-10-12T11:42:09Z", "generator": { "date": "2026-10-12T11:42:09Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1790884160", "initial_release_date": "2026-10-01T19:50:18Z", "revision_history": [ { "date": "2026-10-01T19:50:18Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-05T11:06:15Z", "number": "2", "summary": "Update document" }, { "date": "2026-10-06T09:02:14Z", "number": "3", "summary": "Update document" }, { "date": "2026-10-12T11:42:09Z", "number": "4", "summary": "Update document" } ], "status": "final", "version": "4" }, "title": "nodejs: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.8", "product": { "name": "AlmaLinux 9.8", "product_id": "AlmaLinux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.8", "product": { "name": "Rocky Linux 9.8", "product_id": "Rocky Linux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/v8-devel@9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs@16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-devel@16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/npm@8.19.4_1.16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-full-i18n@16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_id": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-libs@16.20.2-8.el9_8.tuxcare.els20?arch=x86_64&epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/v8-devel@9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs@16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-devel@16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/npm@8.19.4_1.16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-full-i18n@16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_id": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-libs@16.20.2-8.el9_8.tuxcare.els20?arch=i686&epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/v8-devel@9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs@16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-devel@16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/npm@8.19.4_1.16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-full-i18n@16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=1" } } }, { "category": "product_version", "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_id": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-libs@16.20.2-8.el9_8.tuxcare.els20?arch=aarch64&epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "product": { "name": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "product_id": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nodejs-docs@16.20.2-8.el9_8.tuxcare.els20?arch=noarch&epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch" }, "product_reference": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64" }, "product_reference": "nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch" }, "product_reference": "nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "relates_to_product_reference": "Rocky Linux-9.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-22020", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "description", "text": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-22020" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/07/11/6", "url": "http://www.openwall.com/lists/oss-security/2024/07/11/6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/07/19/3", "url": "http://www.openwall.com/lists/oss-security/2024/07/19/3" }, { "category": "external", "summary": "https://hackerone.com/reports/2092749", "url": "https://hackerone.com/reports/2092749" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241122-0006/", "url": "https://security.netapp.com/advisory/ntap-20241122-0006/" } ], "release_date": "2024-07-09T02:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-6733", "cwe": { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, "notes": [ { "category": "description", "text": "Impact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nDisable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-6733" }, { "category": "external", "summary": "https://cna.openjsf.org/security-advisories.html", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52", "url": "https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52" }, { "category": "external", "summary": "https://hackerone.com/reports/3582376", "url": "https://hackerone.com/reports/3582376" } ], "release_date": "2026-06-17T18:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2025-23167", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" }, "notes": [ { "category": "description", "text": "A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\\r\\n\\rX` instead of the required `\\r\\n\\r\\n`.\nThis inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.\n\nThe issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.\n\nImpact:\n* This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-23167" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/may-2025-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/may-2025-security-releases" } ], "release_date": "2025-05-19T02:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-28863", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-28863" }, { "category": "external", "summary": "https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7", "url": "https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7" }, { "category": "external", "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36", "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240524-0005/", "url": "https://security.netapp.com/advisory/ntap-20240524-0005/" } ], "release_date": "2024-03-21T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-48934", "notes": [ { "category": "description", "text": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48934" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-48928", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48928" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-48930", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48930" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-21637", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21637" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases" } ], "release_date": "2026-01-20T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-21714", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21714" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases" } ], "release_date": "2026-03-30T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-22150", "cwe": { "id": "CWE-330", "name": "Use of Insufficiently Random Values" }, "notes": [ { "category": "description", "text": "Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22150" }, { "category": "external", "summary": "https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f", "url": "https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f" }, { "category": "external", "summary": "https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113", "url": "https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113" }, { "category": "external", "summary": "https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0", "url": "https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0" }, { "category": "external", "summary": "https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a", "url": "https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a" }, { "category": "external", "summary": "https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385", "url": "https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385" }, { "category": "external", "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975", "url": "https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975" }, { "category": "external", "summary": "https://hackerone.com/reports/2913312", "url": "https://hackerone.com/reports/2913312" } ], "release_date": "2025-01-21T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-48618", "cwe": { "id": "CWE-176", "name": "Improper Handling of Unicode Encoding" }, "notes": [ { "category": "description", "text": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:28727", "url": "https://access.redhat.com/errata/RHSA-2026:28727" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:29012", "url": "https://access.redhat.com/errata/RHSA-2026:29012" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30172", "url": "https://access.redhat.com/errata/RHSA-2026:30172" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35841", "url": "https://access.redhat.com/errata/RHSA-2026:35841" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35842", "url": "https://access.redhat.com/errata/RHSA-2026:35842" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35891", "url": "https://access.redhat.com/errata/RHSA-2026:35891" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35892", "url": "https://access.redhat.com/errata/RHSA-2026:35892" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39246", "url": "https://access.redhat.com/errata/RHSA-2026:39246" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39868", "url": "https://access.redhat.com/errata/RHSA-2026:39868" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41947", "url": "https://access.redhat.com/errata/RHSA-2026:41947" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52399", "url": "https://access.redhat.com/errata/RHSA-2026:52399" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7378", "url": "https://access.redhat.com/errata/RHSA-2026:7378" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9455", "url": "https://access.redhat.com/errata/RHSA-2026:9455" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48618", "url": "https://access.redhat.com/security/cve/CVE-2026-48618" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json" } ], "release_date": "2026-06-26T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-21710", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21710" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7080", "url": "https://access.redhat.com/errata/RHSA-2026:7080" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7123", "url": "https://access.redhat.com/errata/RHSA-2026:7123" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7302", "url": "https://access.redhat.com/errata/RHSA-2026:7302" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7310", "url": "https://access.redhat.com/errata/RHSA-2026:7310" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7350", "url": "https://access.redhat.com/errata/RHSA-2026:7350" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7670", "url": "https://access.redhat.com/errata/RHSA-2026:7670" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7675", "url": "https://access.redhat.com/errata/RHSA-2026:7675" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7896", "url": "https://access.redhat.com/errata/RHSA-2026:7896" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7983", "url": "https://access.redhat.com/errata/RHSA-2026:7983" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8339", "url": "https://access.redhat.com/errata/RHSA-2026:8339" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9711", "url": "https://access.redhat.com/errata/RHSA-2026:9711" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9874", "url": "https://access.redhat.com/errata/RHSA-2026:9874" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-21710", "url": "https://access.redhat.com/security/cve/CVE-2026-21710" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json" } ], "release_date": "2026-03-30T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-23085", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\r\n\r\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-23085" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00031.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00031.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250321-0003/", "url": "https://security.netapp.com/advisory/ntap-20250321-0003/" } ], "release_date": "2025-02-07T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-01T19:49:22.433731Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160", "product_ids": [ "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "AlmaLinux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-devel-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-docs-1:16.20.2-8.el9_8.tuxcare.els20.noarch", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-full-i18n-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:nodejs-libs-1:16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:npm-1:8.19.4_1.16.20.2-8.el9_8.tuxcare.els20.x86_64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.aarch64", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.i686", "Rocky Linux-9.8:v8-devel-2:9.4.146.26_1.16.20.2-8.el9_8.tuxcare.els20.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1790884160" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }