Every CVE Search/ Get API key

CVE-2026-27135

nghttp2 Denial of service: Assertion failure due to the missing state validation

7.5 HighFix available

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.82%Up 0.8 points since Mar 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

nghttp2 Denial of service: Assertion failure due to the missing state validation

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617, CWE-617
Updated
2026-11-02
EUVDEUVD-2026-12919 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
EUVD-2026-12919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSVALPINE-CVE-2026-27135 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
ALPINE-CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-27135 7.5
Record
BELL-CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

nghttp2 Denial of service: Assertion failure due to the missing state validation

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
Show 47 moreShow less
OSVDEBIAN-CVE-2026-27135 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
DEBIAN-CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-5 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
JLSEC-2026-5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1754 7.5

nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.

Security Fix(es):

A security vulnerability exists in nghttp2 library where missing state validation leads to assertion failure, which can be exploited by attackers to cause denial of service.(CVE-2026-27135)

Record
OESA-2026-1754
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:27200 8.2

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update

Record
RHSA-2026:27200
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:6190 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:6190
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7080 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7123 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7302 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7310 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7310
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7350 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7666 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:7666
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7667 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:7667
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7668 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:7668
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7670 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7675 7.5

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:77939 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:77939
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7896 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7983 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7983
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8339 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8538 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8538
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8539 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8539
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8540 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8540
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8541 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8545 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8545
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8546 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8546
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8547 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8547
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8548 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8548
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8868 7.5

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:8868
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9711 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9874 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9874
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7080 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7123 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7302 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7350 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7666 7.5

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7666
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7667 7.5

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7667
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7668 7.5

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7668
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7670 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7675 7.5

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7896 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:8339 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27135 7.5

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Record
UBUNTU-CVE-2026-27135
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:7080 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7080
Updated
2026-11-02
OSVALSA-2026:7123 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7123
Updated
2026-11-02
OSVALSA-2026:7350 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7350
Updated
2026-11-02
OSVALSA-2026:7666 No score

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7666
Updated
2026-11-02
OSVALSA-2026:7667 No score

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7667
Updated
2026-11-02

Affected products

Show 26 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
nghttp2
Alpine:v3.21
 before 1.68.1
1.68.1
nghttp2
Alpine:v3.22
 before 1.68.1
1.68.1
nghttp2
Alpine:v3.23
 before 1.68.1
1.68.1
nghttp2
Alpine:v3.24
 before 1.68.1-r0
1.68.1-r0
nodejs-docs
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-libs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
Show 290 moreShow less
Affected packages
PackageAffectedFixed
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3.0.1-1.module_el8.10.0+4006+3c416519
3.0.1-1.module_el8.10.0+4006+3c416519
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
v8-12.4-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+198+8bf605ba
2021.06-6.module_el9.7.0+198+8bf605ba
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
libnghttp2
AlmaLinux:10
 before 1.64.0-2.el10_1.1
1.64.0-2.el10_1.1
libnghttp2-devel
AlmaLinux:10
 before 1.64.0-2.el10_1.1
1.64.0-2.el10_1.1
nghttp2
AlmaLinux:10
 before 1.64.0-2.el10_1.1
1.64.0-2.el10_1.1
libnghttp2
AlmaLinux:8
 before 1.33.0-6.el8_10.2
1.33.0-6.el8_10.2
libnghttp2-devel
AlmaLinux:8
 before 1.33.0-6.el8_10.2
1.33.0-6.el8_10.2
nghttp2
AlmaLinux:8
 before 1.33.0-6.el8_10.2
1.33.0-6.el8_10.2
libnghttp2
AlmaLinux:9
 before 1.43.0-6.el9_7.1
1.43.0-6.el9_7.1
libnghttp2-devel
AlmaLinux:9
 before 1.43.0-6.el9_7.1
1.43.0-6.el9_7.1
nghttp2
AlmaLinux:9
 before 1.43.0-6.el9_7.1
1.43.0-6.el9_7.1
nodejs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-docs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-nodemon
AlmaLinux:9
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el9.5.0+125+8dc38870
3.0.1-1.module_el9.5.0+125+8dc38870
nodejs-packaging
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
nodejs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-docs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el8.10.0+3982+85c136aa
3.0.1-1.module_el8.10.0+3982+85c136aa
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
npm
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
nghttp2
Azure Linux:3
 before 1.61.0-3
1.61.0-3
cmake
Azure Linux:3
 before 3.30.3-13
3.30.3-13
nodejs
Azure Linux:3
 before 20.14.0-14
20.14.0-14
nghttp2
Alpaquita:23
 1.51.0-r0 up to 1.51.0-r4
1.51.0-r4
nghttp2
Alpaquita:25
 1.65.0-r0 up to 1.65.0-r1
1.65.0-r1
nghttp2
Alpaquita:stream
 1.52.0-r0 up to 1.68.1-r0
1.68.1-r0
nghttp2
BellSoft Hardened Containers:23
 1.51.0-r0 up to 1.51.0-r4
1.51.0-r4
nghttp2
BellSoft Hardened Containers:25
 1.65.0-r0 up to 1.65.0-r1
1.65.0-r1
nghttp2
BellSoft Hardened Containers:stream
 1.52.0-r0 up to 1.68.1-r0
1.68.1-r0
nodejs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els13
1:16.20.2-8.el9_2.tuxcare.els13
nodejs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els13
1:16.20.2-8.el9_2.tuxcare.els13
nodejs-docs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els13
1:16.20.2-8.el9_2.tuxcare.els13
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els13
1:16.20.2-8.el9_2.tuxcare.els13
nodejs-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els13
1:16.20.2-8.el9_2.tuxcare.els13
npm
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els13
1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els13
v8-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els13
2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els13
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els13
1:16.20.2-8.el9_6.tuxcare.els13
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els13
1:16.20.2-8.el9_6.tuxcare.els13
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els13
1:16.20.2-8.el9_6.tuxcare.els13
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els13
1:16.20.2-8.el9_6.tuxcare.els13
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els13
1:16.20.2-8.el9_6.tuxcare.els13
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els13
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els13
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els13
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els13
libnghttp2
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9.tuxcare.els1
1.43.0-6.el9.tuxcare.els1
libnghttp2-devel
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9.tuxcare.els1
1.43.0-6.el9.tuxcare.els1
nghttp2
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9.tuxcare.els1
1.43.0-6.el9.tuxcare.els1
libnghttp2
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.43.0-5.el9_2.1.tuxcare.els2
1.43.0-5.el9_2.1.tuxcare.els2
libnghttp2-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.43.0-5.el9_2.1.tuxcare.els2
1.43.0-5.el9_2.1.tuxcare.els2
nghttp2
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.43.0-5.el9_2.1.tuxcare.els2
1.43.0-5.el9_2.1.tuxcare.els2
libnghttp2-14
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
libnghttp2-dev
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
libnghttp2-doc
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
nghttp2
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
nghttp2-client
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
nghttp2-proxy
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
nghttp2-server
TuxCare:Debian:10
 before 1.36.0-2+deb10u3+tuxcare.els2
1.36.0-2+deb10u3+tuxcare.els2
nghttp2
Debian:12
 before 1.52.0-1+deb12u3, plus listed versions
1.52.0-11.52.0-1+deb12u11.52.0-1+deb12u2
1.52.0-1+deb12u3
nghttp2
Debian:13
 before 1.64.0-1.1+deb13u1, plus listed versions
1.64.0-1.1
1.64.0-1.1+deb13u1
nghttp2
Debian:14
 before 1.68.1-1, plus listed versions
1.64.0-1.11.68.0-11.68.0-2
1.68.1-1
nghttp2_jll
Julia
 before 1.68.1+0
1.68.1+0
nghttp2
Mageia:9
 before 1.61.0-1.1.mga9
1.61.0-1.1.mga9
nghttp2
openEuler:20.03-LTS-SP4
 before 1.41.0-7.oe2003sp4
1.41.0-7.oe2003sp4
nghttp2
openEuler:22.03-LTS-SP4
 before 1.46.0-7.oe2203sp4
1.46.0-7.oe2203sp4
nghttp2
openEuler:24.03-LTS
 before 1.58.0-3.oe2403sp3
1.58.0-3.oe2403sp3
nghttp2
openEuler:24.03-LTS-SP1
 before 1.58.0-3.oe2403sp1
1.58.0-3.oe2403sp1
nghttp2
openEuler:24.03-LTS-SP2
 before 1.58.0-3.oe2403sp2
1.58.0-3.oe2403sp2
nghttp2
openEuler:24.03-LTS-SP3
 before 1.58.0-3.oe2403sp3
1.58.0-3.oe2403sp3
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_http2
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el7jbcs
0:2.0.29-10.el7jbcs
jbcs-httpd24-mod_http2-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el7jbcs
0:2.0.29-10.el7jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el7jbcs
1:2.4.62-13.el7jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el7jbcs
0:2.4.62-13.el7jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el7jbcs
1:2.4.62-13.el7jbcs
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-httpd-tools-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_http2
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el8jbcs
0:2.0.29-10.el8jbcs
jbcs-httpd24-mod_http2-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.0.29-10.el8jbcs
0:2.0.29-10.el8jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ldap-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_proxy_html-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_session-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:2.4.62-13.el8jbcs
0:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-mod_ssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.62-13.el8jbcs
1:2.4.62-13.el8jbcs
jbcs-httpd24-nghttp2
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el7jbcs
0:1.64.0-3.el7jbcs
jbcs-httpd24-nghttp2
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-nghttp2-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-nghttp2-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 0:1.64.0-3.el8jbcs
0:1.64.0-3.el8jbcs
jbcs-httpd24-mod_md
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el7jbcs
1:2.4.28-16.el7jbcs
jbcs-httpd24-mod_md-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el7jbcs
1:2.4.28-16.el7jbcs
jbcs-httpd24-mod_md
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el8jbcs
1:2.4.28-16.el8jbcs
jbcs-httpd24-mod_md-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 10 CVEs
 before 1:2.4.28-16.el8jbcs
1:2.4.28-16.el8jbcs
libnghttp2
Red Hat:hummingbird:1
 before 0:1.68.1-1.hum1
0:1.68.1-1.hum1
libnghttp2-devel
Red Hat:hummingbird:1
 before 0:1.68.1-1.hum1
0:1.68.1-1.hum1
mingw32-libnghttp2
Red Hat:hummingbird:1
 before 0:1.68.1-1.hum1
0:1.68.1-1.hum1
mingw64-libnghttp2
Red Hat:hummingbird:1
 before 0:1.68.1-1.hum1
0:1.68.1-1.hum1
nghttp2
Red Hat:hummingbird:1
 before 0:1.68.1-1.hum1
0:1.68.1-1.hum1
nodejs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.el10_1
1:10.9.7-1.22.22.2.1.el10_1
nodejs22
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs22-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el8.10.0+24148+847b6786
1:22.22.2-1.module+el8.10.0+24148+847b6786
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+24148+847b6786
0:3.0.1-1.module+el8.10.0+24148+847b6786
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+24148+847b6786
0:2021.06-6.module+el8.10.0+24148+847b6786
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module+el9.7.0+24157+8ddb2461
1:22.22.2-1.module+el9.7.0+24157+8ddb2461
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+24157+8ddb2461
0:3.0.1-1.module+el9.7.0+24157+8ddb2461
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+24157+8ddb2461
0:2021.06-6.module+el9.7.0+24157+8ddb2461
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461
nodejs22
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nghttp2
Rocky Linux:10
 before 0:1.64.0-2.el10_1.1
0:1.64.0-2.el10_1.1
nghttp2
Rocky Linux:8
 before 0:1.33.0-6.el8_10.2
0:1.33.0-6.el8_10.2
nghttp2
Rocky Linux:9
 before 0:1.43.0-6.el9_7.1
0:1.43.0-6.el9_7.1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs24
Rocky Linux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nghttp2
Root:Alpine:3.15
 before 1.46.0-r20071
1.46.0-r200711.46.0-r20072
rootio-nghttp2
Root:Alpine:3.15
 before 1.46.0-r20071
1.46.0-r200711.46.0-r20072
nghttp2
Root:Alpine:3.20
 before 1.62.1-r00071
1.62.1-r000711.62.1-r00072
rootio-nghttp2
Root:Alpine:3.20
 before 1.62.1-r00071
1.62.1-r000711.62.1-r00072
nghttp2
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 1.39.2-3.23.1
1.39.2-3.23.1
nghttp2
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.39.2-3.23.1
1.39.2-3.23.1
nghttp2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.64.0-150700.3.3.1
1.64.0-150700.3.3.1
nghttp2
SUSE:Linux Enterprise Micro 5.3
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Micro 5.4
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Micro 5.5
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Micro 5.2
 before 1.40.0-150200.22.1
1.40.0-150200.22.1
nghttp2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.40.0-150600.25.5.1
1.40.0-150600.25.5.1
nghttp2
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.40.0-150600.25.5.1
1.40.0-150600.25.5.1
nghttp2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.40.0-150600.25.5.1
1.40.0-150600.25.5.1
nghttp2
openSUSE:Leap 15.6
 before 1.40.0-150600.25.5.1
1.40.0-150600.25.5.1
nghttp2-python
openSUSE:Leap 15.6
 before 1.40.0-150600.25.5.1
1.40.0-150600.25.5.1
nghttp2
SUSE:Linux Micro 6.2
 before 1.64.0-160000.3.1
1.64.0-160000.3.1
nghttp2
SUSE:Linux Micro 6.0
 before 1.52.0-6.1
1.52.0-6.1
nghttp2
SUSE:Linux Enterprise Server 16.0
 before 1.64.0-160000.3.1
1.64.0-160000.3.1
nghttp2
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.64.0-160000.3.1
1.64.0-160000.3.1
cockpit
SUSE:Linux Micro 6.0
 before 309-9.1
309-9.1
nghttp2
SUSE:Linux Micro 6.1
 before 1.52.0-slfo.1.1_2.1
1.52.0-slfo.1.1_2.1
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 21 CVEs
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 19 CVEs
 before 22.23.0-150700.3.12.1
22.23.0-150700.3.12.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs18
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nghttp2
Ubuntu:Pro:16.04:LTS
 before 1.7.1-1ubuntu0.1~esm3, plus listed versions
0.6.7-11.3.4-21.4.0-11.4.0-21.5.0-2
Show 5 moreShow less
1.6.0-11.7.0-11.7.1-11.7.1-1ubuntu0.1~esm11.7.1-1ubuntu0.1~esm2
1.7.1-1ubuntu0.1~esm3
nghttp2
Ubuntu:Pro:18.04:LTS
 before 1.30.0-1ubuntu1+esm3, plus listed versions
1.25.0-11.27.0-11.28.0-11.29.0-11.29.0-1build1
Show 4 moreShow less
1.30.0-11.30.0-1ubuntu11.30.0-1ubuntu1+esm11.30.0-1ubuntu1+esm2
1.30.0-1ubuntu1+esm3
nghttp2
Ubuntu:Pro:20.04:LTS
 before 1.40.0-1ubuntu0.3+esm1, plus listed versions
1.39.2-11.40.0-11.40.0-1build11.40.0-1ubuntu0.11.40.0-1ubuntu0.21.40.0-1ubuntu0.3
1.40.0-1ubuntu0.3+esm1
nghttp2
Ubuntu:22.04:LTS
 before 1.43.0-1ubuntu0.3, plus listed versions
1.43.0-11.43.0-1build11.43.0-1build21.43.0-1build31.43.0-1ubuntu0.11.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
nghttp2
Ubuntu:24.04:LTS
 before 1.59.0-1ubuntu0.3, plus listed versions
1.55.1-11.57.0-11.58.0-11.59.0-11.59.0-1build1
Show 4 moreShow less
1.59.0-1build21.59.0-1build41.59.0-1ubuntu0.11.59.0-1ubuntu0.2
1.59.0-1ubuntu0.3
nghttp2
Ubuntu:25.10
 before 1.64.0-1.1ubuntu1.1, plus listed versions
1.64.0-1ubuntu11.64.0-1.11.64.0-1.1build11.64.0-1.1ubuntu1
1.64.0-1.1ubuntu1.1
nghttp2
Ubuntu:26.04:LTS
 before 1.68.0-2ubuntu0.1, plus listed versions
1.64.0-1.1ubuntu11.64.0-1.1ubuntu21.68.0-11.68.0-2
1.68.0-2ubuntu0.1
nghttp2
openSUSE:Tumbleweed
 before 1.68.1-1.1
1.68.1-1.1
nodejs24
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 24.17.0-1.1
24.17.0-1.1
nghttp2
openSUSE:Leap 16.0
 before 1.64.0-160000.3.1
1.64.0-160000.3.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27135 is a high vulnerability (CVSS 7.5) in Nghttp2, published March 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in nghttp2 1.68.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 206 package rows and 208 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 43 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open