Every CVE Search/ Get API key

CVE-2026-54272

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

6.9 MediumFix available

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.40%Up 0.1 points since Jul 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
CVE-2026-54272
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
EUVDEUVD-2026-49375 6.9

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
EUVD-2026-49375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-22jq-vg5j-6vgg 6.9

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Summary

Address6's special-property checks misclassify IPv4-mapped (::ffff:0:0/96) and NAT64 well-known (64:ff9b::/96) IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so isLoopback(), isLinkLocal(), isMulticast(), and isUnspecified() all return false for literals such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254 that actually route to loopback, RFC 1918, or link-local (cloud-metadata) destinations. Address6 also had no isPrivate() method, so a mapped RFC 1918 address could not be detected at all.

An application that builds a network trust-boundary decision on these checks (for example, a filter intended to block Server-Side Request Forgery, or SSRF) may therefore treat an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.

Details

Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges.

The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. The underlying CIDR matching is correct; the defect is that the special-use table omitted the IPv4-mapped range and the checks performed no embedded-IPv4 normalization.

Affected versions

>= 10.1.1, <= 10.2.0. The is* classification API was introduced for Address4 in 10.1.1 and extended to Address6 in 10.2.0. Releases before 10.1.1 do not expose this API and are not affected through this vector.

Impact

The misclassification covers the entire ::ffff:0:0/96 range, in both dotted and hex notation and case-insensitively, plus the 64:ff9b::/96 NAT64 well-known prefix:

| Address | Reported as | Actually points at | |---|---|---| | ::ffff:127.0.0.1 / ::ffff:7f00:1 | Global unicast | loopback (127.0.0.0/8) | | ::ffff:10.0.0.1 | Global unicast | RFC 1918 10/8 | | ::ffff:172.16.5.5 | Global unicast | RFC 1918 172.16/12 | | ::ffff:192.168.1.1 | Global unicast | RFC 1918 192.168/16 | | ::ffff:169.254.169.254 / ::ffff:a9fe:a9fe | Global unicast | link-local / cloud metadata (IMDS) | | ::ffff:100.64.0.1 | Global unicast | CGNAT 100.64/10 | | ::ffff:0.0.0.0 / ::ffff:255.255.255.255 | Global unicast | unspecified / broadcast | | 64:ff9b::7f00:1 / 64:ff9b::a9fe:a9fe | NAT64 (well-known) | loopback / IMDS via NAT64 |

For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.

Proof of concept

A guard assembled from these checks lets internal hosts through:

const { Address4, Address6 } = require('ip-address');

// true => block as internal, false => allow outbound
function isBlocked(host) {
  try {
    const a = new Address4(host);
    return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()
        || a.isMulticast() || a.isUnspecified() || a.isBroadcast();
  } catch {}
  try {
    const a = new Address6(host);
    return a.isLoopback() || a.isLinkLocal() || a.isULA()
        || a.isMulticast() || a.isUnspecified();
  } catch {}
  return false;
}

for (const h of ['127.0.0.1',…
Record
GHSA-22jq-vg5j-6vgg
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
NVD 6.9

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
CVE-2026-54272
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSV 6.9

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
CVE-2026-54272
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54272 6.9

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
DEBIAN-CVE-2026-54272
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 32 moreShow less
OSVGHSA-22jq-vg5j-6vgg 6.9

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Summary

Address6's special-property checks misclassify IPv4-mapped (::ffff:0:0/96) and NAT64 well-known (64:ff9b::/96) IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so isLoopback(), isLinkLocal(), isMulticast(), and isUnspecified() all return false for literals such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254 that actually route to loopback, RFC 1918, or link-local (cloud-metadata) destinations. Address6 also had no isPrivate() method, so a mapped RFC 1918 address could not be detected at all.

An application that builds a network trust-boundary decision on these checks (for example, a filter intended to block Server-Side Request Forgery, or SSRF) may therefore treat an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.

Details

Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges.

The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. The underlying CIDR matching is correct; the defect is that the special-use table omitted the IPv4-mapped range and the checks performed no embedded-IPv4 normalization.

Affected versions

>= 10.1.1, <= 10.2.0. The is* classification API was introduced for Address4 in 10.1.1 and extended to Address6 in 10.2.0. Releases before 10.1.1 do not expose this API and are not affected through this vector.

Impact

The misclassification covers the entire ::ffff:0:0/96 range, in both dotted and hex notation and case-insensitively, plus the 64:ff9b::/96 NAT64 well-known prefix:

| Address | Reported as | Actually points at | |---|---|---| | ::ffff:127.0.0.1 / ::ffff:7f00:1 | Global unicast | loopback (127.0.0.0/8) | | ::ffff:10.0.0.1 | Global unicast | RFC 1918 10/8 | | ::ffff:172.16.5.5 | Global unicast | RFC 1918 172.16/12 | | ::ffff:192.168.1.1 | Global unicast | RFC 1918 192.168/16 | | ::ffff:169.254.169.254 / ::ffff:a9fe:a9fe | Global unicast | link-local / cloud metadata (IMDS) | | ::ffff:100.64.0.1 | Global unicast | CGNAT 100.64/10 | | ::ffff:0.0.0.0 / ::ffff:255.255.255.255 | Global unicast | unspecified / broadcast | | 64:ff9b::7f00:1 / 64:ff9b::a9fe:a9fe | NAT64 (well-known) | loopback / IMDS via NAT64 |

For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.

Proof of concept

A guard assembled from these checks lets internal hosts through:

const { Address4, Address6 } = require('ip-address');

// true => block as internal, false => allow outbound
function isBlocked(host) {
  try {
    const a = new Address4(host);
    return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()
        || a.isMulticast() || a.isUnspecified() || a.isBroadcast();
  } catch {}
  try {
    const a = new Address6(host);
    return a.isLoopback() || a.isLinkLocal() || a.isULA()
        || a.isMulticast() || a.isUnspecified();
  } catch {}
  return false;
}

for (const h of ['127.0.0.1',…
Record
GHSA-22jq-vg5j-6vgg
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSVRHSA-2026:54371 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55601 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:55601
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55603 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:58819 8.6

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:62416 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:62416
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:54371 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55603 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:58819 8.6

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54272 6.9

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Record
UBUNTU-CVE-2026-54272
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:54371 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54371
Updated
2026-11-02
OSVALSA-2026:55601 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55601
Updated
2026-11-02
OSVALSA-2026:55603 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55603
Updated
2026-11-02
OSVALSA-2026:58819 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:58819
Updated
2026-11-02
OSVCLSA-2026-1788790498 No score

TuxCare security update for ip-address (2 CVEs)

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 6.4.0-tuxcare.2.

Record
CLSA-2026-1788790498
Updated
2026-11-02
OSVCLSA-2026-1790890883 No score

TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4.

Record
CLSA-2026-1790890883
Updated
2026-11-02
OSVCLSA-2026-1792451467 No score

TuxCare security update for ip-address (6 CVEs)

TuxCare rebuilt ip-address to address 6 CVEs. Fixed in 10.1.1-tuxcare.1.

Record
CLSA-2026-1792451467
Updated
2026-11-02
OSVCLSA-2026-1792476227 No score

TuxCare security update for ip-address (7 CVEs)

TuxCare rebuilt ip-address to address 7 CVEs. Fixed in 10.1.0-tuxcare.1.

Record
CLSA-2026-1792476227
Updated
2026-11-02
OSVCLSA-2026-1792486210 No score

TuxCare security update for ip-address (2 CVEs)

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 9.0.5-tuxcare.4.

Record
CLSA-2026-1792486210
Updated
2026-11-02
OSVopenSUSE-SU-2026:11611-1 No score

nodejs26-26.7.0-1.1 on GA media

These are all security issues fixed in the nodejs26-26.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11611-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12134-1 No score

corepack24-24.21.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12134-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21545-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
openSUSE-SU-2026:21545-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21546-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
openSUSE-SU-2026:21546-1
Updated
2026-11-02
OSVSUSE-SU-2026:23130-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23130-1
Updated
2026-11-02
OSVSUSE-SU-2026:23131-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23131-1
Updated
2026-11-02
OSVSUSE-SU-2026:23154-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23154-1
Updated
2026-11-02
OSVSUSE-SU-2026:23155-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23155-1
Updated
2026-11-02
OSVSUSE-SU-2026:3520-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58041: node:sqlite SQLTagStore iterator replay can re-execute writes (bsc#1272946).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

Other updates and bugfixes:

  • Version 24.18.0:
    • fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
Record
SUSE-SU-2026:3520-1
Updated
2026-11-02
OSVSUSE-SU-2026:3521-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:3521-1
Updated
2026-11-02
OSVSUSE-SU-2026:3557-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:3557-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ip-address
npm
 10.1.1 to 10.2.0
10.2.1
nodejs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-docs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-libs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
Show 131 moreShow less
Affected packages
PackageAffectedFixed
v8-13.6-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el9.8.0+291+0bb98cce
3.1.14-2.module_el9.8.0+291+0bb98cce
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
v8-12.4-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
v8-13.6-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
nodejs24
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
ip-address
TuxCare:npm
From an advisory covering 2 CVEs
 6.4.0-tuxcare.0 up to 6.4.0-tuxcare.2, plus listed versions
6.4.06.4.0-tuxcare.1
6.4.0-tuxcare.2
ip-address
TuxCare:npm
From an advisory covering 3 CVEs
 7.1.0-tuxcare.0 up to 7.1.0-tuxcare.4, plus listed versions
7.1.07.1.0-tuxcare.17.1.0-tuxcare.27.1.0-tuxcare.3
7.1.0-tuxcare.4
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.1-tuxcare.0 up to 10.1.1-tuxcare.1, plus listed versions
10.1.1
10.1.1-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.0-tuxcare.0 up to 10.1.0-tuxcare.1, plus listed versions
10.1.0
10.1.0-tuxcare.1
ip-address
TuxCare:npm
 9.0.5-tuxcare.0 up to 9.0.5-tuxcare.4, plus listed versions
9.0.59.0.5-tuxcare.19.0.5-tuxcare.29.0.5-tuxcare.3
9.0.5-tuxcare.4
node-ip-address
Debian:14
 before 10.3.1-1, plus listed versions
10.2.0-110.2.0-28.1.0-28.1.0-3
10.3.1-1
ip-address
npm
 10.1.1 up to 10.2.1
10.2.1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+24639+56878497
0:3.1.14-2.module+el8.10.0+24639+56878497
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el9.8.0+24637+e0b636e5
0:3.1.14-2.module+el9.8.0+24637+e0b636e5
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+24638+75f46aee
0:3.1.14-3.module+el9.8.0+24638+75f46aee
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
nodejs
Rocky Linux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs
Rocky Linux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+40281+14cc6568
1:24.18.0-6.module+el9.8.0+40281+14cc6568
nodejs-nodemon
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs24
Rocky Linux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 12 CVEs
 before 24.18.1-150700.15.16.1
24.18.1-150700.15.16.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 11 CVEs
 before 22.23.2-150600.13.24.1
22.23.2-150600.13.24.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 11 CVEs
 before 22.23.2-150600.13.24.1
22.23.2-150600.13.24.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 11 CVEs
 before 22.23.2-150700.3.18.1
22.23.2-150700.3.18.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
node-ip-address
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.3.0-1
 None known
node-ip-address
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.0-18.1.0-2
 None known
node-ip-address
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.1.0-2
 None known
node-ip-address
Ubuntu:26.10
 All versions, plus listed versions
8.1.0-310.2.0-210.3.1-110.4.0-1
 None known
node-ip-address
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.1.0-28.1.0-3
 None known
nodejs26
openSUSE:Tumbleweed
 before 26.7.0-1.1
26.7.0-1.1
nodejs24
openSUSE:Tumbleweed
 before 24.21.0-1.1
24.21.0-1.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54272 is a medium vulnerability (CVSS 6.9) in Beaugunderson Ip-address, published July 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in ip-address 10.2.1.

References

Show 189 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open