RHSA-2026:98619

Vulnerability from csaf_redhat - Published: 2026-11-11 13:48 - Updated: 2026-11-11 22:54
Summary
Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for nodejs26 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617) * nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) * undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697) * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040) * nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847) * nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850) * nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039) * nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044) * nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042) * nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045) * nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869) * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018) * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383) * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) Bug Fix(es) and Enhancement(s): * nodejs26: Rebase to the latest Node.js 26 release [rhel-10.3.z] (JIRA:RHEL-295502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-13697

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-524 - Use of Cache Containing Sensitive Information
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch —
Vendor Fix fix
Threats
Impact Important
CVE-2026-48615

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.

5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-209 - Generation of Error Message Containing Sensitive Information
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48617

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the `process.report.writeReport()` function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to sensitive information or other confidentiality impacts under specific configurations.

2.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CWE-73 - External Control of File Name or Path
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48618

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.

7.7 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-289 - Authentication Bypass by Alternate Name
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-48619

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service.

5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48928

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system.

4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-289 - Authentication Bypass by Alternate Name
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48930

A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information.

5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-170 - Improper Null Termination
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48931

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48933

A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-48934

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security (TLS) host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integrity compromise.

4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-48935

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-279 - Incorrect Execution-Assigned Permissions
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-48936

A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the `--allow-net` permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or integrity impact.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-648 - Incorrect Use of Privileged APIs
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-56847

A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-284 - Improper Access Control
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Low
CVE-2026-56848

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-56850

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-303 - Incorrect Implementation of Authentication Algorithm
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58039

A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-73 - External Control of File Name or Path
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.

6.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-322 - Key Exchange without Entity Authentication
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58041

A flaw was found in Node.js's `node:sqlite` module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58042

A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58043

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.

7.5 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-58044

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-58045

A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Moderate
CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-102276

A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-102278

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-105482

A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-158 - Improper Neutralization of Null Byte or NUL Character
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-105483

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-297 - Improper Validation of Certificate with Host Mismatch
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-106069

A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-297 - Improper Validation of Certificate with Host Mismatch
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-109383

A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-109829

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
CVE-2026-109869

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248 - Uncaught Exception
Affected products
Fixed 31 products, the same list as for CVE-2026-13697
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:98619 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2490521 external
https://bugzilla.redhat.com/show_bug.cgi?id=2491494 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493325 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493326 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493329 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493331 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493332 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493333 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493335 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493336 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493337 external
https://bugzilla.redhat.com/show_bug.cgi?id=2508485 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509171 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509175 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509178 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509179 external
https://bugzilla.redhat.com/show_bug.cgi?id=2509653 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510853 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510854 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510857 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510858 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511089 external
https://bugzilla.redhat.com/show_bug.cgi?id=2542700 external
https://bugzilla.redhat.com/show_bug.cgi?id=2542707 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553656 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553677 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553678 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553679 external
https://bugzilla.redhat.com/show_bug.cgi?id=2559870 external
https://bugzilla.redhat.com/show_bug.cgi?id=2559873 external
https://bugzilla.redhat.com/show_bug.cgi?id=2559875 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-13697 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508485 external
https://www.cve.org/CVERecord?id=CVE-2026-13697 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13697 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-48615 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493335 external
https://www.cve.org/CVERecord?id=CVE-2026-48615 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48615 external
https://nodejs.org/en/blog/vulnerability/june-202… external
https://access.redhat.com/security/cve/CVE-2026-48617 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490521 external
https://www.cve.org/CVERecord?id=CVE-2026-48617 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48617 external
http://hackerone.com/reports/3692858 external
https://access.redhat.com/security/cve/CVE-2026-48618 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493337 external
https://www.cve.org/CVERecord?id=CVE-2026-48618 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48618 external
https://access.redhat.com/security/cve/CVE-2026-48619 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493325 external
https://www.cve.org/CVERecord?id=CVE-2026-48619 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48619 external
https://access.redhat.com/security/cve/CVE-2026-48928 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493333 external
https://www.cve.org/CVERecord?id=CVE-2026-48928 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48928 external
https://access.redhat.com/security/cve/CVE-2026-48930 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493326 external
https://www.cve.org/CVERecord?id=CVE-2026-48930 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48930 external
https://github.com/nodejs/node/commit/7dafafa2424… external
https://hackerone.com/reports/3656716 external
https://access.redhat.com/security/cve/CVE-2026-48931 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491494 external
https://www.cve.org/CVERecord?id=CVE-2026-48931 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48931 external
https://access.redhat.com/security/cve/CVE-2026-48933 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493331 external
https://www.cve.org/CVERecord?id=CVE-2026-48933 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48933 external
https://access.redhat.com/security/cve/CVE-2026-48934 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493332 external
https://www.cve.org/CVERecord?id=CVE-2026-48934 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48934 external
https://access.redhat.com/security/cve/CVE-2026-48935 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493329 external
https://www.cve.org/CVERecord?id=CVE-2026-48935 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48935 external
https://access.redhat.com/security/cve/CVE-2026-48936 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493336 external
https://www.cve.org/CVERecord?id=CVE-2026-48936 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48936 external
https://access.redhat.com/security/cve/CVE-2026-56847 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509178 external
https://www.cve.org/CVERecord?id=CVE-2026-56847 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56847 external
https://nodejs.org/en/blog/vulnerability/july-202… external
https://access.redhat.com/security/cve/CVE-2026-56848 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511089 external
https://www.cve.org/CVERecord?id=CVE-2026-56848 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56848 external
https://access.redhat.com/security/cve/CVE-2026-56850 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509179 external
https://www.cve.org/CVERecord?id=CVE-2026-56850 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56850 external
https://access.redhat.com/security/cve/CVE-2026-58039 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509653 external
https://www.cve.org/CVERecord?id=CVE-2026-58039 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58039 external
https://nodejs.org/en/blog/vulnerability external
https://access.redhat.com/security/cve/CVE-2026-58040 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509175 external
https://www.cve.org/CVERecord?id=CVE-2026-58040 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58040 external
https://access.redhat.com/security/cve/CVE-2026-58041 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510858 external
https://www.cve.org/CVERecord?id=CVE-2026-58041 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58041 external
https://access.redhat.com/security/cve/CVE-2026-58042 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510854 external
https://www.cve.org/CVERecord?id=CVE-2026-58042 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58042 external
https://access.redhat.com/security/cve/CVE-2026-58043 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509171 external
https://www.cve.org/CVERecord?id=CVE-2026-58043 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58043 external
https://access.redhat.com/security/cve/CVE-2026-58044 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510853 external
https://www.cve.org/CVERecord?id=CVE-2026-58044 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58044 external
https://access.redhat.com/security/cve/CVE-2026-58045 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510857 external
https://www.cve.org/CVERecord?id=CVE-2026-58045 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58045 external
https://access.redhat.com/security/cve/CVE-2026-87018 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553677 external
https://www.cve.org/CVERecord?id=CVE-2026-87018 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87018 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-102276 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542707 external
https://www.cve.org/CVERecord?id=CVE-2026-102276 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102276 external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/s… external
https://access.redhat.com/security/cve/CVE-2026-102278 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542700 external
https://www.cve.org/CVERecord?id=CVE-2026-102278 external
https://nvd.nist.gov/vuln/detail/CVE-2026-102278 external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/s… external
https://access.redhat.com/security/cve/CVE-2026-105482 self
https://bugzilla.redhat.com/show_bug.cgi?id=2559875 external
https://www.cve.org/CVERecord?id=CVE-2026-105482 external
https://nvd.nist.gov/vuln/detail/CVE-2026-105482 external
https://nodejs.org/en/blog/release/v22.23.4 external
https://nodejs.org/en/blog/vulnerability/october-… external
https://access.redhat.com/security/cve/CVE-2026-105483 self
https://bugzilla.redhat.com/show_bug.cgi?id=2559870 external
https://www.cve.org/CVERecord?id=CVE-2026-105483 external
https://nvd.nist.gov/vuln/detail/CVE-2026-105483 external
https://nodejs.org/en/blog/release/v24.22.1 external
https://access.redhat.com/security/cve/CVE-2026-106069 self
https://bugzilla.redhat.com/show_bug.cgi?id=2559873 external
https://www.cve.org/CVERecord?id=CVE-2026-106069 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106069 external
https://access.redhat.com/security/cve/CVE-2026-109383 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553678 external
https://www.cve.org/CVERecord?id=CVE-2026-109383 external
https://nvd.nist.gov/vuln/detail/CVE-2026-109383 external
https://github.com/nodejs/undici/commit/f75eac00ac17 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-109829 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553679 external
https://www.cve.org/CVERecord?id=CVE-2026-109829 external
https://nvd.nist.gov/vuln/detail/CVE-2026-109829 external
https://github.com/nodejs/undici/commit/26c2bfb3def0 external
https://github.com/nodejs/undici/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-109869 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553656 external
https://www.cve.org/CVERecord?id=CVE-2026-109869 external
https://nvd.nist.gov/vuln/detail/CVE-2026-109869 external
https://github.com/nodejs/undici/commit/b5084c7dc239 external
https://github.com/nodejs/undici/security/advisor… external
Acknowledgments
Hasan Flayyih Abdullah
anagnorisis2peripeteia
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nodejs26 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)\n\n* nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)\n\n* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)\n\n* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)\n\n* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)\n\n* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\n* undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)\n\n* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n\n* nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)\n\n* nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)\n\n* nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)\n\n* nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)\n\n* nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)\n\n* nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)\n\n* nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)\n\n* nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)\n\n* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs26: Rebase to the latest Node.js 26 release [rhel-10.3.z] (JIRA:RHEL-295502)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:98619",
        "url": "https://access.redhat.com/errata/RHSA-2026:98619"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2490521",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490521"
      },
      {
        "category": "external",
        "summary": "2491494",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491494"
      },
      {
        "category": "external",
        "summary": "2493325",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493325"
      },
      {
        "category": "external",
        "summary": "2493326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"
      },
      {
        "category": "external",
        "summary": "2493329",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493329"
      },
      {
        "category": "external",
        "summary": "2493331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
      },
      {
        "category": "external",
        "summary": "2493332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493332"
      },
      {
        "category": "external",
        "summary": "2493333",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"
      },
      {
        "category": "external",
        "summary": "2493335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
      },
      {
        "category": "external",
        "summary": "2493336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493336"
      },
      {
        "category": "external",
        "summary": "2493337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
      },
      {
        "category": "external",
        "summary": "2508485",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508485"
      },
      {
        "category": "external",
        "summary": "2509171",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
      },
      {
        "category": "external",
        "summary": "2509175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
      },
      {
        "category": "external",
        "summary": "2509178",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
      },
      {
        "category": "external",
        "summary": "2509179",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
      },
      {
        "category": "external",
        "summary": "2509653",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
      },
      {
        "category": "external",
        "summary": "2510853",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
      },
      {
        "category": "external",
        "summary": "2510854",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
      },
      {
        "category": "external",
        "summary": "2510857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
      },
      {
        "category": "external",
        "summary": "2510858",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510858"
      },
      {
        "category": "external",
        "summary": "2511089",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
      },
      {
        "category": "external",
        "summary": "2542700",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
      },
      {
        "category": "external",
        "summary": "2542707",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
      },
      {
        "category": "external",
        "summary": "2553656",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
      },
      {
        "category": "external",
        "summary": "2553677",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
      },
      {
        "category": "external",
        "summary": "2553678",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
      },
      {
        "category": "external",
        "summary": "2553679",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553679"
      },
      {
        "category": "external",
        "summary": "2559870",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559870"
      },
      {
        "category": "external",
        "summary": "2559873",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559873"
      },
      {
        "category": "external",
        "summary": "2559875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559875"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98619.json"
      }
    ],
    "title": "Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-11T22:54:40+00:00",
      "generator": {
        "date": "2026-11-11T22:54:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:98619",
      "initial_release_date": "2026-11-11T13:48:05+00:00",
      "revision_history": [
        {
          "date": "2026-11-11T13:48:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-11T13:48:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-11T22:54:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.3.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debugsource@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debuginfo@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
                "product": {
                  "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
                  "product_id": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs-debuginfo@26.12.1-3.el10_3?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.12.1-3.el10_3.src",
                "product": {
                  "name": "nodejs26-1:26.12.1-3.el10_3.src",
                  "product_id": "nodejs26-1:26.12.1-3.el10_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.12.1-3.el10_3?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debugsource@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debuginfo@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
                "product": {
                  "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
                  "product_id": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs-debuginfo@26.12.1-3.el10_3?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debugsource@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debuginfo@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                "product": {
                  "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                  "product_id": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs-debuginfo@26.12.1-3.el10_3?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-devel-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-devel-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-libs-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-libs-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debugsource@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-debuginfo@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
                "product": {
                  "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
                  "product_id": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs-debuginfo@26.12.1-3.el10_3?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.12.1-3.el10_3.noarch",
                "product": {
                  "name": "nodejs26-docs-1:26.12.1-3.el10_3.noarch",
                  "product_id": "nodejs26-docs-1:26.12.1-3.el10_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.12.1-3.el10_3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch",
                "product": {
                  "name": "nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch",
                  "product_id": "nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.20.0-1.26.12.1.3.el10_3?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.12.1-3.el10_3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src"
        },
        "product_reference": "nodejs26-1:26.12.1-3.el10_3.src",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-devel-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.12.1-3.el10_3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch"
        },
        "product_reference": "nodejs26-docs-1:26.12.1-3.el10_3.noarch",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-libs-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64"
        },
        "product_reference": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le"
        },
        "product_reference": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x"
        },
        "product_reference": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64"
        },
        "product_reference": "nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
        "relates_to_product_reference": "AppStream-10.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        },
        "product_reference": "nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch",
        "relates_to_product_reference": "AppStream-10.3.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13697",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-07-29T17:01:30.886442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508485"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508485",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508485"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"
        }
      ],
      "release_date": "2026-07-29T16:32:39.519000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives"
    },
    {
      "cve": "CVE-2026-48615",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2026-06-26T02:01:59.112093+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact information disclosure flaw in Node.js allows proxy credentials to be exposed in `ERR_PROXY_TUNNEL` error messages. In Red Hat environments, if Node.js applications are configured to embed proxy credentials directly within the proxy URL, these sensitive details could be inadvertently captured by system logs or other error monitoring tools during proxy tunnel error handling.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48615",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48615"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling"
    },
    {
      "cve": "CVE-2026-48617",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-06-18T17:01:57.518340+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490521"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the `process.report.writeReport()` function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to sensitive information or other confidentiality impacts under specific configurations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects Node.js\u0027s experimental Permission Model, a security feature that restricts filesystem, network, and process access when explicitly enabled via the --permission flag. Applications running with the default Node.js configuration (Permission Model not enabled) are not affected. When enabled, insufficient path validation in process.report.writeReport() could allow code running under a restricted permission scope to write a diagnostic report to a location outside the configured allow-list, resulting in low-severity information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490521",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490521"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48617",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48617",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48617"
        },
        {
          "category": "external",
          "summary": "http://hackerone.com/reports/3692858",
          "url": "http://hackerone.com/reports/3692858"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-18T16:21:12.097000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "No workaround is available for applications that rely on the Permission Model to restrict process.report.writeReport() output paths. Users should upgrade to a fixed Node.js release (22.23.0, 24.17.0, or 26.3.1 and later) as they become available downstream.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation"
    },
    {
      "cve": "CVE-2026-48618",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:02:10.741725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS (Transport Layer Security) hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access and confidentiality impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows for a TLS wildcard-depth authentication bypass due to a mismatch in how hostnames and unicode dot separators are handled during authentication. This could enable an attacker to circumvent security boundaries, potentially leading to unauthorized access and compromise of sensitive information in applications utilizing Node.js for TLS connections. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.868000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch"
    },
    {
      "cve": "CVE-2026-48619",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:06.466413+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493325"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in the Node.js HTTP/2 client can lead to a denial of service. A malicious server could exploit this by sending an excessive number of ORIGIN frames, causing the client to consume all available memory. This affects Red Hat products utilizing Node.js as an HTTP/2 client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493325",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493325"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48619",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48619"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.541000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames"
    },
    {
      "cve": "CVE-2026-48928",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-06-26T02:01:48.441706+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS (mutual Transport Layer Security) setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive information or integrity compromise within the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48928",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48928",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48928"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.981000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency"
    },
    {
      "cve": "CVE-2026-48930",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "discovery_date": "2026-06-26T02:01:11.476251+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Node.js TLS hostname handling allows for silent authority rebinding. The vulnerability arises from c-string truncation when processing embedded-nul hostnames in resolver bindings, potentially enabling an attacker to redirect TLS connections to a malicious server. Exploitation requires high attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48930",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48930",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48930"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e",
          "url": "https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3656716",
          "url": "https://hackerone.com/reports/3656716"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:37.006000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling"
    },
    {
      "cve": "CVE-2026-48931",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-06-22T20:00:55.719445+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Low impact flaw in the Node.js HTTP Agent where a client may prematurely accept and process an HTTP response before its corresponding request has been fully sent. This could lead to a client misinterpreting data or entering an unexpected state. Exploitation requires high attack complexity, limiting the practical risk in most Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48931",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48931",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48931"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-22T18:59:30.822000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Limit outbound HTTP/1.1 from Node.js clients to trusted backend endpoints with egress firewall rules or network segmentation. Avoid keep-alive connection pools to untrusted hosts where operationally feasible.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance"
    },
    {
      "cve": "CVE-2026-48933",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-26T02:01:39.107538+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the `subtle.encrypt()` function that is a multiple of 2 gigabytes (GiB). This could lead to a denial of service (DoS) by crashing the Node.js process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Node.js WebCrypto, as a remote attacker can crash the Node.js process by providing a specially crafted large input to the `subtle.encrypt()` function. This could lead to service unavailability in Red Hat environments where Node.js applications process untrusted data with WebCrypto.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48933"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.823000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()"
    },
    {
      "cve": "CVE-2026-48934",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-06-26T02:01:43.284771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security (TLS) host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Certification validation bypass in TLS host verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48934",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48934",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48934"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.894000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Certification validation bypass in TLS host verification"
    },
    {
      "cve": "CVE-2026-48935",
      "cwe": {
        "id": "CWE-279",
        "name": "Incorrect Execution-Assigned Permissions"
      },
      "discovery_date": "2026-06-26T02:01:29.191932+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493329"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized file metadata modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493329",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493329"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48935",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48935",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48935"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.641000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized file metadata modification"
    },
    {
      "cve": "CVE-2026-48936",
      "cwe": {
        "id": "CWE-648",
        "name": "Incorrect Use of Privileged APIs"
      },
      "discovery_date": "2026-06-26T02:02:04.921691+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the `--allow-net` permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or integrity impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Local server can be started without network permission via Permission API flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48936",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48936",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48936"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
        }
      ],
      "release_date": "2026-06-26T01:14:36.878000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Local server can be started without network permission via Permission API flaw"
    },
    {
      "cve": "CVE-2026-56847",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-07-30T07:06:56.246824+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509178"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using `trace_events.createTracing().enable()`. This limited integrity impact permits specific log files to be written outside the intended `--allow-fs-write` boundary.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509178",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.099000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions"
    },
    {
      "cve": "CVE-2026-56848",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-04T17:00:59.804520+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511089"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A remote attacker can exploit an Important heap use-after-free vulnerability in Node.js HTTP/2 to crash applications. The flaw, caused by re-entrant memory operations, leads to a denial of service for Red Hat environments with HTTP/2 enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511089",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56848",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T15:57:24.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service"
    },
    {
      "cve": "CVE-2026-56850",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-07-30T07:07:33.628354+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client\u0027s identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw"
    },
    {
      "cve": "CVE-2026-58039",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-07-31T01:00:57.616263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Information disclosure due to improper permission enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\n\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\n\nSystems and applications that do not actively enable Node.js\u0027s experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability",
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ],
      "release_date": "2026-07-31T00:18:49.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Information disclosure due to improper permission enforcement"
    },
    {
      "cve": "CVE-2026-58040",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2026-07-30T07:05:01.799571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTPS Agent TLS session reuse skips hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\n\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:49.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTPS Agent TLS session reuse skips hostname verification"
    },
    {
      "cve": "CVE-2026-58041",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-08-04T01:01:19.967417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510858"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s `node:sqlite` module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts data Integrity with zero effect on Confidentiality or Availability (C:N, I:H, A:N). Practical exploitation occurs when an application utilizes the experimental `node:sqlite` SQL tag store feature while managing statement iterators. Under these high-complexity conditions (AC:H) requiring specific user-driven interaction sequences (UI:R), a stale iterator can execute a reset statement with new parameters, leading to unintended database writes. Applications that do not use `node:sqlite` tag stores or statement iterators are completely unaffected. Red Hat and upstream CVSS scores align at 5.3 (Moderate) due to these strict operational constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510858",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510858"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.112000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Applications using Node.js that leverage the experimental `node:sqlite` SQL tag store feature should avoid using `DatabaseSync#createTagStore()` and `StatementSyncIterator` to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator"
    },
    {
      "cve": "CVE-2026-58042",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:08.018401+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of \u0027A\u0027 records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate DoS flaw affects Node.js applications using dns.resolveAny(). An attacker can crash the process by providing a DNS response with more than 256 \u0027A\u0027 records. Requiring the ability to manipulate DNS responses increases the attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58042",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.362000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records"
    },
    {
      "cve": "CVE-2026-58043",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-07-30T07:02:23.280145+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509171"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application\u0027s sandboxing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509171",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw"
    },
    {
      "cve": "CVE-2026-58044",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2026-08-04T01:01:05.249056+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Request smuggling via HTTP client header truncation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw impacts Confidentiality and Integrity with zero effect on Availability (C:L, I:L, A:N). Practical exploitation occurs when Node.js operates as a forwarding proxy that reconstructs outbound headers from incoming requests while piping the message body over reused backend connections. Header desynchronization between internal processing and application-visible headers allows HTTP request smuggling. Standard Node.js web applications, non-proxy architectures, or proxies that do not reuse backend socket connections are completely unaffected. Red Hat assesses Confidentiality at Low (C:L) rather than None (C:N) because request smuggling in a proxy environment can expose sensitive adjacent request data, resulting in a 4.8 score versus CVEOrg\u0027s 3.7.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Request smuggling via HTTP client header truncation"
    },
    {
      "cve": "CVE-2026-58045",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-08-04T01:01:17.162622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts Availability with zero effect on Confidentiality or Integrity (C:N, I:N, A:H). Practical exploitation occurs when an application passes attacker-controlled typed array objects into synchronous `node:zlib` functions, triggering an internal assertion and crashing the Node.js process. Applications using asynchronous `node:zlib` routines or processing standard binary buffers are unaffected. Both Red Hat and CVEOrg scores align at 6.2 (Moderate) with a Local attack vector (AV:L), reflecting that an attacker must be able to inject malformed array structures directly into the application\u0027s synchronous data stream.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58045",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.266000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service vulnerability"
    },
    {
      "cve": "CVE-2026-87018",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-10-15T18:45:26.683580+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553677"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553677",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"
        }
      ],
      "release_date": "2026-10-15T18:38:25.613000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate"
    },
    {
      "cve": "CVE-2026-102276",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:02:20.910434+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        }
      ],
      "release_date": "2026-09-28T20:50:59.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
    },
    {
      "cve": "CVE-2026-102278",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:00:55.949756+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        }
      ],
      "release_date": "2026-09-28T20:57:09.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Hasan Flayyih Abdullah"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-105482",
      "cwe": {
        "id": "CWE-158",
        "name": "Improper Neutralization of Null Byte or NUL Character"
      },
      "discovery_date": "2026-10-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-105482"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-105482",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-105482"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/release/v22.23.4",
          "url": "https://nodejs.org/en/blog/release/v22.23.4"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
        }
      ],
      "release_date": "2026-10-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Hasan Flayyih Abdullah"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-105483",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2026-10-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559870"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a hostname that contains fullwidth Unicode digits which normalize to an IPv4 address, together with a certificate that satisfies the incorrect matching behavior. Attack Complexity is High because the attacker must influence the host string used for the connection (for example a user-supplied URL) and present a suitable certificate, typically with a privileged network position relative to that connection. Confidentiality and Integrity are High because a successful bypass enables server impersonation and exposure or alteration of TLS application data; Availability is not affected. This flaw affects Node.js 24.x and 26.x lines and does not affect the 22.x line per the upstream advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-105483"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559870",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559870"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-105483",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-105483"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/release/v24.22.1",
          "url": "https://nodejs.org/en/blog/release/v24.22.1"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
        }
      ],
      "release_date": "2026-10-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to normalize hostnames and IP representations to standard ASCII before passing destination strings to TLS client calls such as tls.connect, https.request, or fetch: upgrade to Node.js v24.22.1, v26.12.1 (or the fixed Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which fix IP normalization regression in TLS hostname validation to ensure fullwidth digit hostnames are recognized as IP addresses, closing all 2 injection vectors (fullwidth Unicode digit IPv4 connection strings, DNS SAN matching on numeric hostnames). Until patched, this is only a concern on Node.js applications running on 24.x and 26.x runtimes establishing TLS client connections \u2014 Node.js 22.x deployments are unaffected \u2014 so Do not pass untrusted hostnames or URLs that may contain non-ASCII or fullwidth digits into TLS clients, and restrict outbound TLS connections to trusted destinations. As a compensating measure, Restrict outbound requests to a validated destination allowlist to prevent arbitrary attacker-controlled host strings from reaching Node.js TLS clients and Segment services initiating TLS client connections from untrusted networks to prevent attackers from intercepting or impersonating connections. These controls limit blast radius and contain exploitation, but they do not fix the underlying TLS IP hostname normalization defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "anagnorisis2peripeteia"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-106069",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2026-10-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559873"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a non-canonical numeric hostname that normalizes to an IP address for certificate matching while name resolution uses a different interpretation, and a certificate that includes an IP subjectAltName matching the normalized address. Attack Complexity is High due to these prerequisites and the need to influence the connection target or traffic. Confidentiality and Integrity are High for a successful impersonation of a TLS peer; Availability is not affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106069"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559873",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559873"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106069"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106069",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106069"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/release/v22.23.4",
          "url": "https://nodejs.org/en/blog/release/v22.23.4"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
        }
      ],
      "release_date": "2026-10-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        },
        {
          "category": "workaround",
          "details": "To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate and canonicalize numeric hostnames prior to TLS client connection setup to eliminate normalization discrepancies against the platform resolver: upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 (or the fixed Nodejs/Nodejs:22/Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which reject non-canonical IP addresses during hostname verification, closing all 2 injection vectors (IPv4 literal with leading zero octal notation, abbreviated numeric IPv4 address format). Until patched, this is a concern on Node.js TLS client applications connecting to untrusted hostnames across supported platforms, so reject non-canonical numeric hostnames before initiating TLS connections, restrict outbound TLS requests to trusted destinations, and isolate client services handling untrusted connection targets. As a compensating measure, pin expected server certificates or public keys to reject unauthorized peer certificates even if hostname verification is deceived by address normalization differences. These controls limit blast radius and contain exploitation, but they do not fix the underlying hostname normalization discrepancy defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1304 SSRF Prevention (Outbound Request Allowlist) (high)",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames"
    },
    {
      "cve": "CVE-2026-109383",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-15T18:45:43.553803+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553678"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Certificate validation bypass via dropped TLS options in Agent",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553678",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/f75eac00ac17",
          "url": "https://github.com/nodejs/undici/commit/f75eac00ac17"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
        }
      ],
      "release_date": "2026-10-15T18:34:01.468000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent"
    },
    {
      "cve": "CVE-2026-109829",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-10-15T18:45:59.990034+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553679"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because successful exploitation enables remote attackers to achieve shared cache poisoning and unauthorized cross-user data exposure across network boundaries without requiring elevated privileges. Within Red Hat environments shipping Node.js runtimes and associated container services, undici is utilized as an HTTP client backend. However, exploitation requires a specific application architecture where an originless dispatcher chains redirect processing ahead of a shared cache store, rather than the default standalone client configurations. Deployments that do not implement shared caching across multi-origin redirect flows or that isolate cache storage per origin remain unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553679",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553679"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109829",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/26c2bfb3def0",
          "url": "https://github.com/nodejs/undici/commit/26c2bfb3def0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"
        }
      ],
      "release_date": "2026-10-15T18:28:04.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching"
    },
    {
      "cve": "CVE-2026-109869",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-15T18:31:39.700754+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
          "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
          "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
          "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/b5084c7dc239",
          "url": "https://github.com/nodejs/undici/commit/b5084c7dc239"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
        }
      ],
      "release_date": "2026-10-15T18:08:31.243000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T13:48:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.src",
            "AppStream-10.3.Z:nodejs26-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-debugsource-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-devel-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-docs-1:26.12.1-3.el10_3.noarch",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-full-i18n-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.aarch64",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.ppc64le",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.s390x",
            "AppStream-10.3.Z:nodejs26-libs-debuginfo-1:26.12.1-3.el10_3.x86_64",
            "AppStream-10.3.Z:nodejs26-npm-1:11.20.0-1.26.12.1.3.el10_3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.