Vulnerability-Lookup

RHSA-2026:64817

Vulnerability from csaf_redhat - Published: 2026-09-08 05:07 - Updated: 2026-10-23 11:09

Summary

Red Hat Security Advisory: nodejs22 security update

Severity

Important

Notes

Topic: An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-14257

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 38 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-56846

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Important

CVE-2026-56847

A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-284 - Improper Access Control

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Low

CVE-2026-56848

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Important

CVE-2026-56850

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-58039

A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-73 - External Control of File Name or Path

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-322 - Key Exchange without Entity Authentication

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-58042

A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-58043

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.

7.5 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Important

CVE-2026-58044

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-58045

A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Moderate

CVE-2026-69152

A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Important

CVE-2026-69192

A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE-1389 - Incorrect Parsing of Numbers with Different Radices

Affected products

Fixed 38 products, the same list as for CVE-2026-14257

Threats

Impact Important

References

74 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:64817	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2506433	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509171	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510722	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510801	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510856	external
https://bugzilla.redhat.com/show_bug.cgi?id=2511089	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-14257	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506433	external
https://www.cve.org/CVERecord?id=CVE-2026-14257	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14257	external
https://github.com/juliangruber/brace-expansion	external
https://github.com/juliangruber/brace-expansion/c…	external
https://www.npmjs.com/package/brace-expansion	external
https://access.redhat.com/security/cve/CVE-2026-56846	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510856	external
https://www.cve.org/CVERecord?id=CVE-2026-56846	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56846	external
https://nodejs.org/en/blog/vulnerability/july-202…	external
https://access.redhat.com/security/cve/CVE-2026-56847	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509178	external
https://www.cve.org/CVERecord?id=CVE-2026-56847	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56847	external
https://access.redhat.com/security/cve/CVE-2026-56848	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511089	external
https://www.cve.org/CVERecord?id=CVE-2026-56848	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56848	external
https://access.redhat.com/security/cve/CVE-2026-56850	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509179	external
https://www.cve.org/CVERecord?id=CVE-2026-56850	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56850	external
https://access.redhat.com/security/cve/CVE-2026-58039	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509653	external
https://www.cve.org/CVERecord?id=CVE-2026-58039	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58039	external
https://nodejs.org/en/blog/vulnerability	external
https://access.redhat.com/security/cve/CVE-2026-58040	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509175	external
https://www.cve.org/CVERecord?id=CVE-2026-58040	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58040	external
https://access.redhat.com/security/cve/CVE-2026-58042	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510854	external
https://www.cve.org/CVERecord?id=CVE-2026-58042	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58042	external
https://access.redhat.com/security/cve/CVE-2026-58043	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509171	external
https://www.cve.org/CVERecord?id=CVE-2026-58043	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58043	external
https://access.redhat.com/security/cve/CVE-2026-58044	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510853	external
https://www.cve.org/CVERecord?id=CVE-2026-58044	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58044	external
https://access.redhat.com/security/cve/CVE-2026-58045	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510857	external
https://www.cve.org/CVERecord?id=CVE-2026-58045	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58045	external
https://access.redhat.com/security/cve/CVE-2026-69152	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510722	external
https://www.cve.org/CVERecord?id=CVE-2026-69152	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69152	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external
https://access.redhat.com/security/cve/CVE-2026-69192	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510801	external
https://www.cve.org/CVERecord?id=CVE-2026-69192	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69192	external
https://github.com/beaugunderson/ip-address/commi…	external
https://github.com/beaugunderson/ip-address/relea…	external
https://github.com/beaugunderson/ip-address/secur…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n\n* brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n\n* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:64817",
        "url": "https://access.redhat.com/errata/RHSA-2026:64817"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2506433",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
      },
      {
        "category": "external",
        "summary": "2509171",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
      },
      {
        "category": "external",
        "summary": "2510722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
      },
      {
        "category": "external",
        "summary": "2510801",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
      },
      {
        "category": "external",
        "summary": "2510856",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
      },
      {
        "category": "external",
        "summary": "2511089",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64817.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs22 security update",
    "tracking": {
      "current_release_date": "2026-10-23T11:09:39+00:00",
      "generator": {
        "date": "2026-10-23T11:09:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:64817",
      "initial_release_date": "2026-09-08T05:07:07+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T05:07:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-08T05:07:07+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-23T11:09:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-devel-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-devel-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-libs-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-libs-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
                  "product_id": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.8-1.22.23.2.1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_id": "nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.23.2-1.el10_0?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-devel-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-devel-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-libs-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-libs-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
                  "product_id": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.8-1.22.23.2.1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_id": "nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.23.2-1.el10_0?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
                  "product_id": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.8-1.22.23.2.1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_id": "nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.23.2-1.el10_0?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-devel-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-devel-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-libs-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-libs-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
                "product": {
                  "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
                  "product_id": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-npm@10.9.8-1.22.23.2.1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debugsource@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
                "product": {
                  "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_id": "nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-debuginfo@22.23.2-1.el10_0?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:22.23.2-1.el10_0.noarch",
                "product": {
                  "name": "nodejs-docs-1:22.23.2-1.el10_0.noarch",
                  "product_id": "nodejs-docs-1:22.23.2-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@22.23.2-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-1:22.23.2-1.el10_0.src",
                "product": {
                  "name": "nodejs22-1:22.23.2-1.el10_0.src",
                  "product_id": "nodejs22-1:22.23.2-1.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.23.2-1.el10_0?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-devel-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-devel-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-devel-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:22.23.2-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch"
        },
        "product_reference": "nodejs-docs-1:22.23.2-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-libs-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-libs-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-libs-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64"
        },
        "product_reference": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le"
        },
        "product_reference": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x"
        },
        "product_reference": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64"
        },
        "product_reference": "nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-1:22.23.2-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src"
        },
        "product_reference": "nodejs22-1:22.23.2-1.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64"
        },
        "product_reference": "nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le"
        },
        "product_reference": "nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x"
        },
        "product_reference": "nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        },
        "product_reference": "nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14257",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T14:01:26.376839+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n  `-- brace-expansion@2.0.2\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion",
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-07-23T12:54:23.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Do not pass untrusted or user-controlled input to brace-expansion\u0027s expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "cve": "CVE-2026-56846",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:14.342521+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js HTTP/2 handling allows a remote attacker to bypass `maxSessionMemory` limits by sending specially crafted header blocks. This can lead to memory exhaustion and a denial of service for Node.js applications configured to use HTTP/2, without requiring authentication or user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56846",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks"
    },
    {
      "cve": "CVE-2026-56847",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-07-30T07:06:56.246824+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509178"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using `trace_events.createTracing().enable()`. This limited integrity impact permits specific log files to be written outside the intended `--allow-fs-write` boundary.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509178",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.099000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions"
    },
    {
      "cve": "CVE-2026-56848",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-04T17:00:59.804520+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511089"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A remote attacker can exploit an Important heap use-after-free vulnerability in Node.js HTTP/2 to crash applications. The flaw, caused by re-entrant memory operations, leads to a denial of service for Red Hat environments with HTTP/2 enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511089",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56848",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T15:57:24.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service"
    },
    {
      "cve": "CVE-2026-56850",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-07-30T07:07:33.628354+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client\u0027s identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw"
    },
    {
      "cve": "CVE-2026-58039",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-07-31T01:00:57.616263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Information disclosure due to improper permission enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\n\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\n\nSystems and applications that do not actively enable Node.js\u0027s experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability",
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ],
      "release_date": "2026-07-31T00:18:49.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Information disclosure due to improper permission enforcement"
    },
    {
      "cve": "CVE-2026-58040",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2026-07-30T07:05:01.799571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTPS Agent TLS session reuse skips hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\n\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:49.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTPS Agent TLS session reuse skips hostname verification"
    },
    {
      "cve": "CVE-2026-58042",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:08.018401+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of \u0027A\u0027 records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate DoS flaw affects Node.js applications using dns.resolveAny(). An attacker can crash the process by providing a DNS response with more than 256 \u0027A\u0027 records. Requiring the ability to manipulate DNS responses increases the attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58042",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.362000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records"
    },
    {
      "cve": "CVE-2026-58043",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-07-30T07:02:23.280145+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509171"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application\u0027s sandboxing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509171",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw"
    },
    {
      "cve": "CVE-2026-58044",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-08-04T01:01:05.249056+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Request smuggling via HTTP client header truncation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw impacts Confidentiality and Integrity with zero effect on Availability (C:L, I:L, A:N). Practical exploitation occurs when Node.js operates as a forwarding proxy that reconstructs outbound headers from incoming requests while piping the message body over reused backend connections. Header desynchronization between internal processing and application-visible headers allows HTTP request smuggling. Standard Node.js web applications, non-proxy architectures, or proxies that do not reuse backend socket connections are completely unaffected. Red Hat assesses Confidentiality at Low (C:L) rather than None (C:N) because request smuggling in a proxy environment can expose sensitive adjacent request data, resulting in a 4.8 score versus CVEOrg\u0027s 3.7.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Request smuggling via HTTP client header truncation"
    },
    {
      "cve": "CVE-2026-58045",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-08-04T01:01:17.162622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts Availability with zero effect on Confidentiality or Integrity (C:N, I:N, A:H). Practical exploitation occurs when an application passes attacker-controlled typed array objects into synchronous `node:zlib` functions, triggering an internal assertion and crashing the Node.js process. Applications using asynchronous `node:zlib` routines or processing standard binary buffers are unaffected. Both Red Hat and CVEOrg scores align at 6.2 (Moderate) with a Local attack vector (AV:L), reflecting that an attacker must be able to inject malformed array structures directly into the application\u0027s synchronous data stream.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58045",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.266000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service vulnerability"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `ip-address` JavaScript library can lead to Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library\u0027s inconsistent parsing of IP address octets with leading zeros, which it interprets as decimal while the network stack interprets them as octal, can cause applications to misclassify internal IP addresses as external. This discrepancy can bypass security filters designed to prevent access to internal resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
          "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T05:07:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64817"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-devel-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-docs-1:22.23.2-1.el10_0.noarch",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-full-i18n-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-libs-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs-npm-1:10.9.8-1.22.23.2.1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-1:22.23.2-1.el10_0.src",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debuginfo-1:22.23.2-1.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.s390x",
            "AppStream-10.0.Z.E2S:nodejs22-debugsource-1:22.23.2-1.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}

CVE-2026-14257 (GCVE-0-2026-14257)

Vulnerability from cvelistv5 – Published: 2026-07-23 12:54 – Updated: 2026-07-23 14:44

Title

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

Summary

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:44 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

seal CNA under the mitre root

CNA scorecard – unranked: 7 records in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://www.npmjs.com/package/brace-expansion
https://github.com/juliangruber/brace-expansion
https://github.com/juliangruber/brace-expansion/c…

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: 0 , ≤ 5.0.7 (semver)

Credits

bnbdr

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:44:31.208878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:44:41.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com/package/brace-expansion",
          "defaultStatus": "unaffected",
          "packageName": "brace-expansion",
          "platforms": [
            "Linux",
            "macOS",
            "Windows"
          ],
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "lessThanOrEqual": "5.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bnbdr"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ebrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The \u003ccode\u003eexpand()\u003c/code\u003e function limits the number of results with a \u003ccode\u003emax\u003c/code\u003e option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (\u003ccode\u003e\u0027{a,b}\u0027.repeat(1500)\u003c/code\u003e) crashes a default Node.js process. Any application that passes attacker-influenced strings to \u003ccode\u003ebrace-expansion.expand()\u003c/code\u003e - directly or transitively via \u003ccode\u003eminimatch\u003c/code\u003e / \u003ccode\u003eglob\u003c/code\u003e brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a \u003ccode\u003emaxLength\u003c/code\u003e option (default 4,000,000) that bounds accumulated output and intermediate arrays.\u003c/p\u003e"
            }
          ],
          "value": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (\u0027{a,b}\u0027.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T12:54:23.124Z",
        "orgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "shortName": "seal"
      },
      "references": [
        {
          "name": "GHSA-mh99-v99m-4gvg",
          "url": "https://www.npmjs.com/package/brace-expansion"
        },
        {
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
    "assignerShortName": "seal",
    "cveId": "CVE-2026-14257",
    "datePublished": "2026-07-23T12:54:23.124Z",
    "dateReserved": "2026-06-30T15:45:06.757Z",
    "dateUpdated": "2026-07-23T14:44:41.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56846 (GCVE-0-2026-56846)

Vulnerability from cvelistv5 – Published: 2026-08-04 00:49 – Updated: 2026-08-04 15:03

Summary

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 14:28 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56846",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:28:25.511403Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:03:38.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\r\n\r\nThis vulnerability affects Node.js **24.x** and **22.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:49:58.319Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56846",
    "datePublished": "2026-08-04T00:49:58.319Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-08-04T15:03:38.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56847 (GCVE-0-2026-56847)

Vulnerability from cvelistv5 – Published: 2026-07-30 06:02 – Updated: 2026-07-30 12:35

Summary

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 12:34 UTC

CWE

CWE-1119 - Excessive Use of Unconditional Branching

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T12:34:51.815184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T12:35:31.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\r\n\r\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1119",
              "description": "CWE-1119 Excessive Use of Unconditional Branching",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T06:02:50.099Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56847",
    "datePublished": "2026-07-30T06:02:50.099Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-07-30T12:35:31.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56848 (GCVE-0-2026-56848)

Vulnerability from cvelistv5 – Published: 2026-08-04 15:57 – Updated: 2026-08-04 17:36

Summary

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 17:35 UTC

CWE

CWE-416 - Use After Free

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56848",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:35:44.952267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:36:14.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T15:57:24.399Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56848",
    "datePublished": "2026-08-04T15:57:24.399Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-08-04T17:36:14.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56850 (GCVE-0-2026-56850)

Vulnerability from cvelistv5 – Published: 2026-07-30 06:02 – Updated: 2026-07-30 12:37

Summary

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Severity

4.1 (Medium)


                        
                          CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 12:37 UTC

CWE

CWE-287 - Improper Authentication - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56850",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T12:37:02.406813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T12:37:10.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T06:02:50.074Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56850",
    "datePublished": "2026-07-30T06:02:50.074Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-07-30T12:37:10.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58039 (GCVE-0-2026-58039)

Vulnerability from cvelistv5 – Published: 2026-07-31 00:18 – Updated: 2026-07-31 16:01

Summary

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 16:00 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58039",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T16:00:31.468676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T16:01:49.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T00:18:49.050Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58039",
    "datePublished": "2026-07-31T00:18:49.050Z",
    "dateReserved": "2026-06-27T15:00:00.779Z",
    "dateUpdated": "2026-07-31T16:01:49.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58040 (GCVE-0-2026-58040)

Vulnerability from cvelistv5 – Published: 2026-07-30 06:02 – Updated: 2026-07-30 12:50

Summary

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 12:47 UTC

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 22.23.1 , ≤ 22.23.1 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 26.5.0 , ≤ 26.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T12:47:40.363604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-297",
                "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T12:50:20.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\r\n\r\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T06:02:49.942Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58040",
    "datePublished": "2026-07-30T06:02:49.942Z",
    "dateReserved": "2026-06-27T15:00:00.779Z",
    "dateUpdated": "2026-07-30T12:50:20.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58042 (GCVE-0-2026-58042)

Vulnerability from cvelistv5 – Published: 2026-08-04 00:49 – Updated: 2026-08-04 15:03

Summary

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Severity

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 14:19 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:19:36.224340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:03:30.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.\r\n\r\nRepeated triggering of this condition can lead to denial of service.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:49:58.362Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58042",
    "datePublished": "2026-08-04T00:49:58.362Z",
    "dateReserved": "2026-06-27T15:00:00.780Z",
    "dateUpdated": "2026-08-04T15:03:30.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58043 (GCVE-0-2026-58043)

Vulnerability from cvelistv5 – Published: 2026-07-30 06:02 – Updated: 2026-07-31 03:55

Summary

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 00:00 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 22.23.1 , ≤ 22.23.1 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 26.5.0 , ≤ 26.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58043",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T03:55:48.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\r\n\r\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\r\n\r\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T06:02:50.095Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58043",
    "datePublished": "2026-07-30T06:02:50.095Z",
    "dateReserved": "2026-06-27T15:00:00.780Z",
    "dateUpdated": "2026-07-31T03:55:48.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58044 (GCVE-0-2026-58044)

Vulnerability from cvelistv5 – Published: 2026-08-04 00:49 – Updated: 2026-08-04 15:03

Summary

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Severity

3.7 (Low)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 14:19 UTC

CWE

CWE-444 - HTTP Request Smuggling

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 195 records in the last 180 days details

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:19:38.226326Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:03:46.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 HTTP Request Smuggling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:49:58.297Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58044",
    "datePublished": "2026-08-04T00:49:58.297Z",
    "dateReserved": "2026-06-27T15:00:00.780Z",
    "dateUpdated": "2026-08-04T15:03:46.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:64817

CVE-2026-14257 (GCVE-0-2026-14257)

CVE-2026-56846 (GCVE-0-2026-56846)

CVE-2026-56847 (GCVE-0-2026-56847)

CVE-2026-56848 (GCVE-0-2026-56848)

CVE-2026-56850 (GCVE-0-2026-56850)

CVE-2026-58039 (GCVE-0-2026-58039)

CVE-2026-58040 (GCVE-0-2026-58040)

CVE-2026-58042 (GCVE-0-2026-58042)

CVE-2026-58043 (GCVE-0-2026-58043)

CVE-2026-58044 (GCVE-0-2026-58044)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour