RHSA-2026:97855

Vulnerability from csaf_redhat - Published: 2026-11-10 22:35 - Updated: 2026-11-11 22:40
Summary
Red Hat Security Advisory: nodejs:26 security update
Severity
Important
Notes
Topic: An update for the nodejs:26 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617) * nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) * undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697) * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040) * nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847) * nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850) * nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039) * nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044) * nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045) * nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-13697

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-524 - Use of Cache Containing Sensitive Information
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26 —
Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-19534

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-48615

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.

5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-209 - Generation of Error Message Containing Sensitive Information
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48617

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the `process.report.writeReport()` function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to sensitive information or other confidentiality impacts under specific configurations.

2.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CWE-73 - External Control of File Name or Path
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48618

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.

7.7 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-289 - Authentication Bypass by Alternate Name
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-48619

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service.

5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48928

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system.

4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-289 - Authentication Bypass by Alternate Name
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48930

A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information.

5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-170 - Improper Null Termination
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48931

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48933

A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-48934

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security (TLS) host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integrity compromise.

4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48935

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-279 - Incorrect Execution-Assigned Permissions
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48936

A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the `--allow-net` permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or integrity impact.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-648 - Incorrect Use of Privileged APIs
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-56846

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-56847

A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-284 - Improper Access Control
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-56848

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-56850

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-303 - Incorrect Implementation of Authentication Algorithm
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58039

A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-73 - External Control of File Name or Path
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.

6.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-322 - Key Exchange without Entity Authentication
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58041

A flaw was found in Node.js's `node:sqlite` module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58042

A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58043

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.

7.5 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-58044

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58045

A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-84961

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-85152

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 40 products, the same list as for CVE-2026-13697
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:97855 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2490521 external
https://bugzilla.redhat.com/show_bug.cgi?id=2491494 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493325 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493326 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493329 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493331 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493332 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493333 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493335 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493336 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493337 external
https://bugzilla.redhat.com/show_bug.cgi?id=2508485 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509171 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509175 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509178 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509179 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509653 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510853 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510854 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510856 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510857 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510858 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511089 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528717 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528735 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528759 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-13697 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508485 external
https://www.cve.org/CVERecord?id=CVE-2026-13697 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13697 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-19534 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528759 external
https://www.cve.org/CVERecord?id=CVE-2026-19534 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19534 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-48615 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493335 external
https://www.cve.org/CVERecord?id=CVE-2026-48615 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48615 external
https://nodejs.org/en/blog/vulnerability/june-202… external
https://access.redhat.com/security/cve/CVE-2026-48617 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490521 external
https://www.cve.org/CVERecord?id=CVE-2026-48617 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48617 external
http://hackerone.com/reports/3692858 external
https://access.redhat.com/security/cve/CVE-2026-48618 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493337 external
https://www.cve.org/CVERecord?id=CVE-2026-48618 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48618 external
https://access.redhat.com/security/cve/CVE-2026-48619 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493325 external
https://www.cve.org/CVERecord?id=CVE-2026-48619 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48619 external
https://access.redhat.com/security/cve/CVE-2026-48928 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493333 external
https://www.cve.org/CVERecord?id=CVE-2026-48928 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48928 external
https://access.redhat.com/security/cve/CVE-2026-48930 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493326 external
https://www.cve.org/CVERecord?id=CVE-2026-48930 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48930 external
https://github.com/nodejs/node/commit/7dafafa2424… external
https://hackerone.com/reports/3656716 external
https://access.redhat.com/security/cve/CVE-2026-48931 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491494 external
https://www.cve.org/CVERecord?id=CVE-2026-48931 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48931 external
https://access.redhat.com/security/cve/CVE-2026-48933 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493331 external
https://www.cve.org/CVERecord?id=CVE-2026-48933 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48933 external
https://access.redhat.com/security/cve/CVE-2026-48934 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493332 external
https://www.cve.org/CVERecord?id=CVE-2026-48934 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48934 external
https://access.redhat.com/security/cve/CVE-2026-48935 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493329 external
https://www.cve.org/CVERecord?id=CVE-2026-48935 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48935 external
https://access.redhat.com/security/cve/CVE-2026-48936 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493336 external
https://www.cve.org/CVERecord?id=CVE-2026-48936 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48936 external
https://access.redhat.com/security/cve/CVE-2026-56846 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510856 external
https://www.cve.org/CVERecord?id=CVE-2026-56846 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56846 external
https://nodejs.org/en/blog/vulnerability/july-202… external
https://access.redhat.com/security/cve/CVE-2026-56847 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509178 external
https://www.cve.org/CVERecord?id=CVE-2026-56847 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56847 external
https://access.redhat.com/security/cve/CVE-2026-56848 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511089 external
https://www.cve.org/CVERecord?id=CVE-2026-56848 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56848 external
https://access.redhat.com/security/cve/CVE-2026-56850 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509179 external
https://www.cve.org/CVERecord?id=CVE-2026-56850 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56850 external
https://access.redhat.com/security/cve/CVE-2026-58039 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509653 external
https://www.cve.org/CVERecord?id=CVE-2026-58039 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58039 external
https://nodejs.org/en/blog/vulnerability external
https://access.redhat.com/security/cve/CVE-2026-58040 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509175 external
https://www.cve.org/CVERecord?id=CVE-2026-58040 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58040 external
https://access.redhat.com/security/cve/CVE-2026-58041 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510858 external
https://www.cve.org/CVERecord?id=CVE-2026-58041 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58041 external
https://access.redhat.com/security/cve/CVE-2026-58042 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510854 external
https://www.cve.org/CVERecord?id=CVE-2026-58042 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58042 external
https://access.redhat.com/security/cve/CVE-2026-58043 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509171 external
https://www.cve.org/CVERecord?id=CVE-2026-58043 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58043 external
https://access.redhat.com/security/cve/CVE-2026-58044 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510853 external
https://www.cve.org/CVERecord?id=CVE-2026-58044 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58044 external
https://access.redhat.com/security/cve/CVE-2026-58045 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510857 external
https://www.cve.org/CVERecord?id=CVE-2026-58045 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58045 external
https://access.redhat.com/security/cve/CVE-2026-84961 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528735 external
https://www.cve.org/CVERecord?id=CVE-2026-84961 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84961 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-85152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528717 external
https://www.cve.org/CVERecord?id=CVE-2026-85152 external
https://nvd.nist.gov/vuln/detail/CVE-2026-85152 external
https://github.com/nodejs/undici/security/advisor… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the nodejs:26 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)\n\n* nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)\n\n* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)\n\n* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)\n\n* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)\n\n* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\n* undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)\n\n* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n\n* nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)\n\n* nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)\n\n* nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)\n\n* nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)\n\n* nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)\n\n* nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)\n\n* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n\n* nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)\n\n* nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)\n\n* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)\n\n* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:97855",
        "url": "https://access.redhat.com/errata/RHSA-2026:97855"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2490521",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490521"
      },
      {
        "category": "external",
        "summary": "2491494",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491494"
      },
      {
        "category": "external",
        "summary": "2493325",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493325"
      },
      {
        "category": "external",
        "summary": "2493326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"
      },
      {
        "category": "external",
        "summary": "2493329",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493329"
      },
      {
        "category": "external",
        "summary": "2493331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
      },
      {
        "category": "external",
        "summary": "2493332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493332"
      },
      {
        "category": "external",
        "summary": "2493333",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"
      },
      {
        "category": "external",
        "summary": "2493335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
      },
      {
        "category": "external",
        "summary": "2493336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493336"
      },
      {
        "category": "external",
        "summary": "2493337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
      },
      {
        "category": "external",
        "summary": "2508485",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508485"
      },
      {
        "category": "external",
        "summary": "2509171",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
      },
      {
        "category": "external",
        "summary": "2509175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
      },
      {
        "category": "external",
        "summary": "2509178",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
      },
      {
        "category": "external",
        "summary": "2509179",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
      },
      {
        "category": "external",
        "summary": "2509653",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
      },
      {
        "category": "external",
        "summary": "2510853",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
      },
      {
        "category": "external",
        "summary": "2510854",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
      },
      {
        "category": "external",
        "summary": "2510856",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
      },
      {
        "category": "external",
        "summary": "2510857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
      },
      {
        "category": "external",
        "summary": "2510858",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510858"
      },
      {
        "category": "external",
        "summary": "2511089",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
      },
      {
        "category": "external",
        "summary": "2528717",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528717"
      },
      {
        "category": "external",
        "summary": "2528735",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
      },
      {
        "category": "external",
        "summary": "2528759",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97855.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs:26 security update",
    "tracking": {
      "current_release_date": "2026-11-11T22:40:18+00:00",
      "generator": {
        "date": "2026-11-11T22:40:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:97855",
      "initial_release_date": "2026-11-10T22:35:01+00:00",
      "revision_history": [
        {
          "date": "2026-11-10T22:35:01+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-10T22:35:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-11T22:40:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.9.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
                "product": {
                  "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src (nodejs:26)",
                  "product_id": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=src\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src (nodejs:26)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.9.0%2B24923%2Bac50c00f?arch=src\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src (nodejs:26)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.9.0%2B24923%2Bac50c00f?arch=src\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
                "product": {
                  "name": "nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch (nodejs:26)",
                  "product_id": "nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-docs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                "product": {
                  "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26)",
                  "product_id": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-1.module%2Bel9.9.0%2B24923%2Bac50c00f?arch=noarch\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26)",
                  "product_id": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel9.9.0%2B24923%2Bac50c00f?arch=noarch\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel9.9.0%2B24923%2Bac50c00f?arch=noarch\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
                "product": {
                  "name": "npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch (nodejs:26)",
                  "product_id": "npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/npm@11.19.1-1.26.8.2.1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26)",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.8.2.1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26)",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.8.2.1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26)",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.8.2.1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-debugsource@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-devel@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-full-i18n@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@26.8.2-1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26)",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.8.2.1.module%2Bel9.9.0%2B24929%2B16cef9a5?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:26:9090020260922082827:rhel9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26"
        },
        "product_reference": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26"
        },
        "product_reference": "nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26"
        },
        "product_reference": "nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26"
        },
        "product_reference": "nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26"
        },
        "product_reference": "npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13697",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-07-29T17:01:30.886442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508485"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508485",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508485"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"
        }
      ],
      "release_date": "2026-07-29T16:32:39.519000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives"
    },
    {
      "cve": "CVE-2026-19534",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-09-04T17:21:01.599799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528759"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528759",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
        }
      ],
      "release_date": "2026-09-04T17:10:05.081000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
    },
    {
      "cve": "CVE-2026-48615",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2026-06-26T02:01:59.112093+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact information disclosure flaw in Node.js allows proxy credentials to be exposed in `ERR_PROXY_TUNNEL` error messages. In Red Hat environments, if Node.js applications are configured to embed proxy credentials directly within the proxy URL, these sensitive details could be inadvertently captured by system logs or other error monitoring tools during proxy tunnel error handling.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48615",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling"
    },
    {
      "cve": "CVE-2026-48617",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-06-18T17:01:57.518340+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490521"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the `process.report.writeReport()` function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to sensitive information or other confidentiality impacts under specific configurations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects Node.js\u0027s experimental Permission Model, a security feature that restricts filesystem, network, and process access when explicitly enabled via the --permission flag. Applications running with the default Node.js configuration (Permission Model not enabled) are not affected. When enabled, insufficient path validation in process.report.writeReport() could allow code running under a restricted permission scope to write a diagnostic report to a location outside the configured allow-list, resulting in low-severity information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490521",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490521"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48617",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48617",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "http://hackerone.com/reports/3692858",
          "url": "http://hackerone.com/reports/3692858"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-18T16:21:12.097000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "No workaround is available for applications that rely on the Permission Model to restrict process.report.writeReport() output paths. Users should upgrade to a fixed Node.js release (22.23.0, 24.17.0, or 26.3.1 and later) as they become available downstream.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation"
    },
    {
      "cve": "CVE-2026-48618",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:02:10.741725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows for a TLS wildcard-depth authentication bypass due to a mismatch in how hostnames and unicode dot separators are handled during authentication. This could enable an attacker to circumvent security boundaries, potentially leading to unauthorized access and compromise of sensitive information in applications utilizing Node.js for TLS connections. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.868000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch"
    },
    {
      "cve": "CVE-2026-48619",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:06.466413+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493325"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in the Node.js HTTP/2 client can lead to a denial of service. A malicious server could exploit this by sending an excessive number of ORIGIN frames, causing the client to consume all available memory. This affects Red Hat products utilizing Node.js as an HTTP/2 client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493325",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493325"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48619",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.541000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames"
    },
    {
      "cve": "CVE-2026-48928",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:01:48.441706+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48928",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48928",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.981000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency"
    },
    {
      "cve": "CVE-2026-48930",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "discovery_date": "2026-06-26T02:01:11.476251+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Node.js TLS hostname handling allows for silent authority rebinding. The vulnerability arises from c-string truncation when processing embedded-nul hostnames in resolver bindings, potentially enabling an attacker to redirect TLS connections to a malicious server. Exploitation requires high attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48930",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48930",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e",
          "url": "https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3656716",
          "url": "https://hackerone.com/reports/3656716"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:37.006000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling"
    },
    {
      "cve": "CVE-2026-48931",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-06-22T20:00:55.719445+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Low impact flaw in the Node.js HTTP Agent where a client may prematurely accept and process an HTTP response before its corresponding request has been fully sent. This could lead to a client misinterpreting data or entering an unexpected state. Exploitation requires high attack complexity, limiting the practical risk in most Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48931",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48931",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-22T18:59:30.822000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Limit outbound HTTP/1.1 from Node.js clients to trusted backend endpoints with egress firewall rules or network segmentation. Avoid keep-alive connection pools to untrusted hosts where operationally feasible.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance"
    },
    {
      "cve": "CVE-2026-48933",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:39.107538+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Node.js WebCrypto, as a remote attacker can crash the Node.js process by providing a specially crafted large input to the `subtle.encrypt()` function. This could lead to service unavailability in Red Hat environments where Node.js applications process untrusted data with WebCrypto.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.823000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()"
    },
    {
      "cve": "CVE-2026-48934",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-06-26T02:01:43.284771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security (TLS) host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Certification validation bypass in TLS host verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48934",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48934",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.894000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Certification validation bypass in TLS host verification"
    },
    {
      "cve": "CVE-2026-48935",
      "cwe": {
        "id": "CWE-279",
        "name": "Incorrect Execution-Assigned Permissions"
      },
      "discovery_date": "2026-06-26T02:01:29.191932+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493329"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized file metadata modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493329",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493329"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48935",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48935",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.641000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized file metadata modification"
    },
    {
      "cve": "CVE-2026-48936",
      "cwe": {
        "id": "CWE-648",
        "name": "Incorrect Use of Privileged APIs"
      },
      "discovery_date": "2026-06-26T02:02:04.921691+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the `--allow-net` permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or integrity impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Local server can be started without network permission via Permission API flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48936",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48936",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.878000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Local server can be started without network permission via Permission API flaw"
    },
    {
      "cve": "CVE-2026-56846",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:14.342521+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js HTTP/2 handling allows a remote attacker to bypass `maxSessionMemory` limits by sending specially crafted header blocks. This can lead to memory exhaustion and a denial of service for Node.js applications configured to use HTTP/2, without requiring authentication or user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56846",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks"
    },
    {
      "cve": "CVE-2026-56847",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-07-30T07:06:56.246824+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509178"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using `trace_events.createTracing().enable()`. This limited integrity impact permits specific log files to be written outside the intended `--allow-fs-write` boundary.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509178",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.099000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions"
    },
    {
      "cve": "CVE-2026-56848",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-04T17:00:59.804520+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511089"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A remote attacker can exploit an Important heap use-after-free vulnerability in Node.js HTTP/2 to crash applications. The flaw, caused by re-entrant memory operations, leads to a denial of service for Red Hat environments with HTTP/2 enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511089",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56848",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T15:57:24.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service"
    },
    {
      "cve": "CVE-2026-56850",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-07-30T07:07:33.628354+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client\u0027s identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw"
    },
    {
      "cve": "CVE-2026-58039",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-07-31T01:00:57.616263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Information disclosure due to improper permission enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\n\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\n\nSystems and applications that do not actively enable Node.js\u0027s experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability",
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ],
      "release_date": "2026-07-31T00:18:49.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Information disclosure due to improper permission enforcement"
    },
    {
      "cve": "CVE-2026-58040",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2026-07-30T07:05:01.799571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTPS Agent TLS session reuse skips hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\n\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:49.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTPS Agent TLS session reuse skips hostname verification"
    },
    {
      "cve": "CVE-2026-58041",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-08-04T01:01:19.967417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510858"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s `node:sqlite` module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts data Integrity with zero effect on Confidentiality or Availability (C:N, I:H, A:N). Practical exploitation occurs when an application utilizes the experimental `node:sqlite` SQL tag store feature while managing statement iterators. Under these high-complexity conditions (AC:H) requiring specific user-driven interaction sequences (UI:R), a stale iterator can execute a reset statement with new parameters, leading to unintended database writes. Applications that do not use `node:sqlite` tag stores or statement iterators are completely unaffected. Red Hat and upstream CVSS scores align at 5.3 (Moderate) due to these strict operational constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510858",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510858"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.112000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Applications using Node.js that leverage the experimental `node:sqlite` SQL tag store feature should avoid using `DatabaseSync#createTagStore()` and `StatementSyncIterator` to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator"
    },
    {
      "cve": "CVE-2026-58042",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:08.018401+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of \u0027A\u0027 records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate DoS flaw affects Node.js applications using dns.resolveAny(). An attacker can crash the process by providing a DNS response with more than 256 \u0027A\u0027 records. Requiring the ability to manipulate DNS responses increases the attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58042",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.362000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records"
    },
    {
      "cve": "CVE-2026-58043",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-07-30T07:02:23.280145+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509171"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application\u0027s sandboxing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509171",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw"
    },
    {
      "cve": "CVE-2026-58044",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-08-04T01:01:05.249056+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Request smuggling via HTTP client header truncation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw impacts Confidentiality and Integrity with zero effect on Availability (C:L, I:L, A:N). Practical exploitation occurs when Node.js operates as a forwarding proxy that reconstructs outbound headers from incoming requests while piping the message body over reused backend connections. Header desynchronization between internal processing and application-visible headers allows HTTP request smuggling. Standard Node.js web applications, non-proxy architectures, or proxies that do not reuse backend socket connections are completely unaffected. Red Hat assesses Confidentiality at Low (C:L) rather than None (C:N) because request smuggling in a proxy environment can expose sensitive adjacent request data, resulting in a 4.8 score versus CVEOrg\u0027s 3.7.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Request smuggling via HTTP client header truncation"
    },
    {
      "cve": "CVE-2026-58045",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-08-04T01:01:17.162622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts Availability with zero effect on Confidentiality or Integrity (C:N, I:N, A:H). Practical exploitation occurs when an application passes attacker-controlled typed array objects into synchronous `node:zlib` functions, triggering an internal assertion and crashing the Node.js process. Applications using asynchronous `node:zlib` routines or processing standard binary buffers are unaffected. Both Red Hat and CVEOrg scores align at 6.2 (Moderate) with a Local attack vector (AV:L), reflecting that an attacker must be able to inject malformed array structures directly into the application\u0027s synchronous data stream.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58045",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.266000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service vulnerability"
    },
    {
      "cve": "CVE-2026-84961",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-04T16:52:40.440125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici\u0027s BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw only affects applications that construct an undici BalancedPool with a function-valued connect or tls option \u2014 for example, a custom checkServerIdentity callback or connector used for certificate pinning across multiple upstreams. Client, Pool, Agent, and RoundRobinPool destructure these options before the internal JSON-based clone and are not affected. An attacker able to present, on the network path, a TLS endpoint whose certificate the application\u0027s custom validator was written to reject \u2014 but which still satisfies Node.js\u0027s default hostname and chain checks \u2014 can have that certificate silently accepted when the connection goes through BalancedPool, enabling a man-in-the-middle attack against affected connections.\nThis affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84961",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"
        }
      ],
      "release_date": "2026-09-04T16:47:55.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line).",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options"
    },
    {
      "cve": "CVE-2026-85152",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-04T16:41:35.623977+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528717"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is present in the undici HTTP client library used by Node.js. When an application composes undici\u0027s Cache or Deduplicate interceptor directly onto a Client or Pool object (rather than onto an Agent), the library\u0027s internal cache and in-flight-request deduplication keys omit the destination origin. As a result, a cached or in-flight response captured for one upstream origin can be returned for a request intended for a different, trusted origin whenever the method, path, and relevant headers match. In the most severe demonstrated scenario, this allowed an attacker-controlled JWT to be accepted by the application as though it had been validated against a legitimate, trusted issuer, without that issuer ever being contacted \u2014 resulting in a full authentication bypass.\nExploitation requires that the affected application attach the Cache or Deduplicate interceptor directly to a Client/Pool \u2014 the default Agent-based dispatch path is not affected, since Agent already carries the origin in its dispatch options \u2014 and that an attacker can influence or collide with the cache/deduplication key for at least one origin the application communicates with.).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
          "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528717",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528717"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
        }
      ],
      "release_date": "2026-09-04T16:36:28.085000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T22:35:01+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97855"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-nodemon-0:3.1.14-1.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-0:2021.06-6.module+el9.9.0+24923+ac50c00f.src::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:nodejs-packaging-bundler-0:2021.06-6.module+el9.9.0+24923+ac50c00f.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:npm-1:11.19.1-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.noarch::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.aarch64::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.ppc64le::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.s390x::nodejs:26",
            "AppStream-9.9.0.Z.MAIN:v8-14.6-devel-3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5.x86_64::nodejs:26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.