Every CVE Search/ Get API key

CVE-2026-42338

ip-address: XSS in Address6 HTML-emitting methods

5.3 MediumFix available

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.47%Up 0.4 points since May 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

ip-address: XSS in Address6 HTML-emitting methods

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
CVE-2026-42338
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-79, CWE-79
Updated
2026-11-02
EUVDEUVD-2026-29785 5.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
EUVD-2026-29785
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v2v4-37r5-5v8g 5.3

ip-address has XSS in Address6 HTML-emitting methods

Summary

Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. A related issue in v6.helpers.spanAll() produced malformed markup but was not exploitable; it is hardened in the same release for consistency.

Details

Four related issues were identified and fixed together:

  1. Address6.group(): zone ID injection. The Address6 constructor stores the raw input (including any IPv6 zone ID) in this.address before zone stripping. group() then passed this.address to helpers.simpleGroup(), which wrapped each :-separated segment in a <span> element without HTML-escaping the content. A zone ID containing HTML markup was embedded verbatim.
  2. Address6.link({ prefix, className }): attribute-value injection. link() concatenated user-supplied prefix and className into the href="…" and class="…" attributes without escaping. A caller passing untrusted content through these options could inject event handlers (e.g. onmouseover) and achieve XSS.
  3. Address6 constructor: leading-zero IPv4 error path. The leading-zero branch in parse4in6() built AddressError.parseMessage by concatenating the raw address through String.replace(). Because parse4in6() runs before the bad-character check, any characters in the groups preceding the IPv4 suffix flowed into the error's HTML unescaped. Consumers who render parseMessage as HTML (its documented purpose — it already contains <span class="parse-error"> markup) could be XSS'd by a crafted input such as <img src=x onerror=alert(1)>:10.0.01.1.
  4. v6.helpers.spanAll(): attribute-value injection (defense in depth). spanAll() embedded each character of its input into a class="digit value-${n} …" attribute without escaping. Because split('') limits n to a single character this was not exploitable in practice, but it produced malformed markup and is fixed for consistency.

Affected Versions

All versions up to and including 10.1.0.

Patched Version

10.1.1.

Impact

Real-world exposure is believed to be extremely limited. Analysis of all 425 dependent npm packages as well as GitHub code search found zero consumers of group(), link(), or spanAll(): these HTML-emitting surfaces appear to be unused across published npm packages and public repositories. Applications using only the address-parsing and comparison APIs (isValid, correctForm, isInSubnet, bigInt, etc.) are not affected.

Consumers who do render the output of group(), link(), spanAll(), or AddressError.parseMessage as HTML against untrusted input should upgrade.

PoC

const { Address6 } = require('ip-address');
const addr = new Address6('fe80::1%<img src=x onerror=alert(1)>');
document.body.innerHTML = addr.group();  // fires the onerror handler in 10.1.0

Workarounds

If users cannot upgrade immediately:

  • Do not pass untrusted input to the Address6 constructor, or
  • Never render the output of group(), link(), or spanAll(), nor the parseMessage field of any thrown AddressError, as HTML; treat these values as text only, or run them through DOMPurify before inserting into the DOM (DOMPurify's default configuration preserves the library's intended <span> wrapping while stripping any injected event handlers), or
  • Validate input with Address6.isValid() and reject anything that contains a zone identifier (a % character) or characters outside [0-9a-fA-F:/] before passing it to the constructor.

Lack…

Record
GHSA-v2v4-37r5-5v8g
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
CVE-2026-42338
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.3

ip-address: XSS in Address6 HTML-emitting methods

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
CVE-2026-42338
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42338 6.1

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
DEBIAN-CVE-2026-42338
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 38 moreShow less
OSVGHSA-v2v4-37r5-5v8g 5.3

ip-address has XSS in Address6 HTML-emitting methods

Summary

Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. A related issue in v6.helpers.spanAll() produced malformed markup but was not exploitable; it is hardened in the same release for consistency.

Details

Four related issues were identified and fixed together:

  1. Address6.group(): zone ID injection. The Address6 constructor stores the raw input (including any IPv6 zone ID) in this.address before zone stripping. group() then passed this.address to helpers.simpleGroup(), which wrapped each :-separated segment in a <span> element without HTML-escaping the content. A zone ID containing HTML markup was embedded verbatim.
  2. Address6.link({ prefix, className }): attribute-value injection. link() concatenated user-supplied prefix and className into the href="…" and class="…" attributes without escaping. A caller passing untrusted content through these options could inject event handlers (e.g. onmouseover) and achieve XSS.
  3. Address6 constructor: leading-zero IPv4 error path. The leading-zero branch in parse4in6() built AddressError.parseMessage by concatenating the raw address through String.replace(). Because parse4in6() runs before the bad-character check, any characters in the groups preceding the IPv4 suffix flowed into the error's HTML unescaped. Consumers who render parseMessage as HTML (its documented purpose — it already contains <span class="parse-error"> markup) could be XSS'd by a crafted input such as <img src=x onerror=alert(1)>:10.0.01.1.
  4. v6.helpers.spanAll(): attribute-value injection (defense in depth). spanAll() embedded each character of its input into a class="digit value-${n} …" attribute without escaping. Because split('') limits n to a single character this was not exploitable in practice, but it produced malformed markup and is fixed for consistency.

Affected Versions

All versions up to and including 10.1.0.

Patched Version

10.1.1.

Impact

Real-world exposure is believed to be extremely limited. Analysis of all 425 dependent npm packages as well as GitHub code search found zero consumers of group(), link(), or spanAll(): these HTML-emitting surfaces appear to be unused across published npm packages and public repositories. Applications using only the address-parsing and comparison APIs (isValid, correctForm, isInSubnet, bigInt, etc.) are not affected.

Consumers who do render the output of group(), link(), spanAll(), or AddressError.parseMessage as HTML against untrusted input should upgrade.

PoC

const { Address6 } = require('ip-address');
const addr = new Address6('fe80::1%<img src=x onerror=alert(1)>');
document.body.innerHTML = addr.group();  // fires the onerror handler in 10.1.0

Workarounds

If users cannot upgrade immediately:

  • Do not pass untrusted input to the Address6 constructor, or
  • Never render the output of group(), link(), or spanAll(), nor the parseMessage field of any thrown AddressError, as HTML; treat these values as text only, or run them through DOMPurify before inserting into the DOM (DOMPurify's default configuration preserves the library's intended <span> wrapping while stripping any injected event handlers), or
  • Validate input with Address6.isValid() and reject anything that contains a zone identifier (a % character) or characters outside [0-9a-fA-F:/] before passing it to the constructor.

Lack…

Record
GHSA-v2v4-37r5-5v8g
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVRHSA-2026:35841 8.1

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35842 8.1

Red Hat Security Advisory: nodejs22 security, bug fix, and enhancement update

Record
RHSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35891 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35892 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:39246 8.1

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:39246
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:39868 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:41947 8.1

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:52399 8.1

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:52399
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:57590 8.6

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Record
RHSA-2026:57590
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:35841 8.1

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35841
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35842 8.1

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35891 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35891
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:35892 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:35892
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:39868 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:39868
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:41947 8.1

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41947
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-42338 6.1

CVE-2026-42338 in ip-address - Patched by Root

Root has patched CVE-2026-42338 in the ip-address package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-42338
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42338 5.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Record
UBUNTU-CVE-2026-42338
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:35841 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35841
Updated
2026-11-02
OSVALSA-2026:35842 No score

Important: nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35842
Updated
2026-11-02
OSVALSA-2026:35891 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35891
Updated
2026-11-02
OSVALSA-2026:35892 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35892
Updated
2026-11-02
OSVALSA-2026:39868 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:39868
Updated
2026-11-02
OSVALSA-2026:41947 No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
  • undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
  • undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)
  • undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)
  • nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
  • nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
  • nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
  • nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
  • nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
  • Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
  • nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
  • nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-8] (JIRA:AlmaLinux-176170)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41947
Updated
2026-11-02
OSVCLSA-2026-1782694761 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 9.0.5-tuxcare.1.

Record
CLSA-2026-1782694761
Updated
2026-11-02
OSVCLSA-2026-1790006158 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3.

Record
CLSA-2026-1790006158
Updated
2026-11-02
OSVCLSA-2026-1790890883 No score

TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4.

Record
CLSA-2026-1790890883
Updated
2026-11-02
OSVCLSA-2026-1792776533 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.1.0-tuxcare.2.

Record
CLSA-2026-1792776533
Updated
2026-11-02
OSVopenSUSE-SU-2026:11121-1 No score

corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11121-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21058-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
openSUSE-SU-2026:21058-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21236-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
openSUSE-SU-2026:21236-1
Updated
2026-11-02
OSVSUSE-SU-2026:22368-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:22368-1
Updated
2026-11-02
OSVSUSE-SU-2026:22565-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
SUSE-SU-2026:22565-1
Updated
2026-11-02
OSVSUSE-SU-2026:2633-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to 24.17.0:

  • CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2633-1
Updated
2026-11-02
OSVSUSE-SU-2026:2647-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2647-1
Updated
2026-11-02
OSVSUSE-SU-2026:2695-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

  • CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
  • CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
  • CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
  • CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
  • CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
  • CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
  • CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
  • CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
  • CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
  • CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
  • CVE-2026-48937: http2: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).
  • CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).
  • CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec ( bsc#1266318).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
Record
SUSE-SU-2026:2695-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02

Affected products

Show 29 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
ip-address
npm
 through 10.1.0
10.1.1
nodejs24
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
Show 202 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el9.8.0+277+61fc613e
1:24.18.0-1.module_el9.8.0+277+61fc613e
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
nodejs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-devel
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-docs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-libs
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el9.8.0+276+8b329b47
1:22.23.1-1.module_el9.8.0+276+8b329b47
nodejs-nodemon
AlmaLinux:9
From an advisory covering 16 CVEs
 before 3.0.1-1.module_el9.7.0+208+fb06c0ab
3.0.1-1.module_el9.7.0+208+fb06c0ab
nodejs-packaging
AlmaLinux:9
From an advisory covering 16 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 16 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47
v8-12.4-devel
AlmaLinux:9
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
nodejs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-docs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-libs
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module_el8.10.0+4228+2938bc94
1:24.18.0-1.module_el8.10.0+4228+2938bc94
nodejs-nodemon
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 18 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
v8-13.6-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94
nodejs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-devel
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-docs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-libs
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
1:22.23.1-1.module_el8.10.0+4231+1bf2f855
nodejs-nodemon
AlmaLinux:8
From an advisory covering 16 CVEs
 before 3.0.1-1.module_el8.10.0+3956+47c9ee9f
3.0.1-1.module_el8.10.0+3956+47c9ee9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 16 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 16 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
v8-12.4-devel
AlmaLinux:8
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
ip-address
TuxCare:npm
 9.0.5-tuxcare.0 up to 9.0.5-tuxcare.1, plus listed versions
9.0.5
9.0.5-tuxcare.1
ip-address
TuxCare:npm
 6.4.0-tuxcare.0 up to 6.4.0-tuxcare.3, plus listed versions
6.4.06.4.0-tuxcare.16.4.0-tuxcare.2
6.4.0-tuxcare.3
ip-address
TuxCare:npm
From an advisory covering 3 CVEs
 7.1.0-tuxcare.0 up to 7.1.0-tuxcare.4, plus listed versions
7.1.07.1.0-tuxcare.17.1.0-tuxcare.27.1.0-tuxcare.3
7.1.0-tuxcare.4
ip-address
TuxCare:npm
 10.1.0-tuxcare.0 up to 10.1.0-tuxcare.2, plus listed versions
10.1.010.1.0-tuxcare.1
10.1.0-tuxcare.2
node-ip-address
Debian:12
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-1
Show 4 moreShow less
10.7.4-110.7.5-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:13
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-1
Show 4 moreShow less
10.7.4-110.7.5-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:14
 before 10.2.0-2, plus listed versions
10.2.0-18.1.0-28.1.0-3
10.2.0-2
ip-address
npm
 before 10.1.1
10.1.1
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.el10_2
1:11.16.0-1.24.18.0.1.el10_2
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.2.el10_2
1:10.9.8-1.22.23.1.2.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 16 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el9.8.0+24456+b244c3b4
1:24.18.0-1.module+el9.8.0+24456+b244c3b4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.8.0+24355+35d95b59
0:3.0.3-3.module+el9.8.0+24355+35d95b59
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
1:11.16.0-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el9.8.0+24457+996af7aa
1:22.23.1-1.module+el9.8.0+24457+996af7aa
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:3.0.1-1.module+el9.8.0+24156+bb41d456
0:3.0.1-1.module+el9.8.0+24156+bb41d456
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:10.9.8-1.22.23.1.2.el10_0
1:10.9.8-1.22.23.1.2.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_0
1:22.23.1-2.el10_0
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:24.18.0-1.module+el8.10.0+24481+7a71fac8
1:24.18.0-1.module+el8.10.0+24481+7a71fac8
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
1:11.16.0-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-1.module+el8.10.0+24500+8eb51621
1:22.23.1-1.module+el8.10.0+24500+8eb51621
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:3.0.1-1.module+el8.10.0+24500+8eb51621
0:3.0.1-1.module+el8.10.0+24500+8eb51621
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.1-2.module+el9.6.0+24604+449f851b
1:22.23.1-2.module+el9.6.0+24604+449f851b
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:3.1.14-1.module+el9.6.0+24604+449f851b
0:3.1.14-1.module+el9.6.0+24604+449f851b
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b
1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b
3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b
rh-podman-desktop
Red Hat:enterprise_linux:10.2
From an advisory covering 24 CVEs
 before 0:1.1.2-1.el10_2
0:1.1.2-1.el10_2
nodejs24
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:24.18.0-1.el10_2
1:24.18.0-1.el10_2
nodejs22
Rocky Linux:10
From an advisory covering 13 CVEs
 before 1:22.23.1-2.el10_2
1:22.23.1-2.el10_2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40165+d075e3f2
0:3.0.1-1.module+el9.7.0+40165+d075e3f2
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el9.7.0+40153+4d595597
0:3.0.1-1.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs
Rocky Linux:8
From an advisory covering 15 CVEs
 before 1:24.18.0-1.module+el8.10.0+40252+a58646bc
1:24.18.0-1.module+el8.10.0+40252+a58646bc
nodejs-nodemon
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 15 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
ip-address
Root:npm
 before 9.0.5-aikido.2
9.0.5-aikido.29.0.5-aikido.310.1.0-aikido.210.0.1-aikido.210.1.0-aikido.39.0.5-aikido.4
@rootio/ip-address
Root:npm
 before 9.0.5-root.io.1
9.0.5-root.io.19.0.5-root.io.29.0.5-root.io.310.1.0-root.io.210.0.1-root.io.210.1.0-root.io.39.0.5-root.io.4
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 21 CVEs
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 19 CVEs
 before 22.23.0-150700.3.12.1
22.23.0-150700.3.12.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
node-ip-address
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.3.0-1
 None known
node-ip-address
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.0-18.1.0-2
 None known
node-ip-address
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.1.0-2
 None known
node-ip-address
Ubuntu:25.10
 All versions, plus listed versions
8.1.0-2
 None known
node-ip-address
Ubuntu:26.10
 All versions, plus listed versions
8.1.0-310.2.0-210.3.1-110.4.0-1
 None known
node-ip-address
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.1.0-28.1.0-3
 None known
nodejs24
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 24.17.0-1.1
24.17.0-1.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42338 is a medium vulnerability (CVSS 5.3) in Beaugunderson Ip-address, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in ip-address 10.1.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 224 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open