Every CVE Search/ Get API key

CVE-2026-56847

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`...

3.3 LowPublic exploitFix available

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.16%Unchanged since Jul 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.3

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
CVE-2026-56847
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1119
Updated
2026-11-02
EUVDEUVD-2026-51022 3.3

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
EUVD-2026-51022
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hw7r-7v27-7388 3.3

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`...

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
GHSA-hw7r-7v27-7388
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1119
Updated
2026-11-02
NVD 6.1

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
CVE-2026-56847
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1119
Updated
2026-11-02
OSVALPINE-CVE-2026-56847 6.1

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
ALPINE-CVE-2026-56847
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-56847 6.1
Record
BELL-CVE-2026-56847
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
Show 37 moreShow less
OSV 3.3

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
CVE-2026-56847
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1119
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56847 6.1

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
DEBIAN-CVE-2026-56847
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:48273 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:48273
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:48305 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:48305
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:48537 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:48537
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61376 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:61376
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61377 7.5

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:61377
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61383 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:61383
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61386 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:61386
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62219 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:62219
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62416 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:62416
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:62583 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:62583
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:64817 8.6

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:64817
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56847 6.1

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
UBUNTU-CVE-2026-56847
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:61376 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61376
Updated
2026-11-02
OSVALSA-2026:61377 No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61377
Updated
2026-11-02
OSVALSA-2026:61383 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61383
Updated
2026-11-02
OSVALSA-2026:61386 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61386
Updated
2026-11-02
OSVALSA-2026:62219 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:62219
Updated
2026-11-02
OSVALSA-2026:62583 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
  • nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
  • nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:62583
Updated
2026-11-02
OSVAZL-94340 No score

CVE-2026-56847 affecting package nodejs for versions less than 24.18.1-1

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
AZL-94340
Updated
2026-11-02
OSVBIT-node-2026-56847 No score

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
BIT-node-2026-56847
Updated
2026-11-02
OSVBIT-node-min-2026-56847 No score

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Record
BIT-node-min-2026-56847
Updated
2026-11-02
OSVMGASA-2026-0359 No score

Updated nodejs packages fix security vulnerabilities

http2: retain header memory in session accounting. (CVE-2026-56846) http2: defer rst stream while in scope. (CVE-2026-56848) permission: avoid granting radix split nodes. (CVE-2026-58043) https: distinguish PFX object-array agent keys. (CVE-2026-56850) https: bind identity checks to session reuse. (CVE-2026-58040) dns: handle large resolveAny address replies. (CVE-2026-58042) zlib: throw on out-of-bounds write buffers. (CVE-2026-58045) permission: enforce fs write permission for trace events. (CVE-2026-56847) permission: check final report output path. (CVE-2026-58039) http: reject requests exceeding max header count. (CVE-2026-58044)

Record
MGASA-2026-0359
Updated
2026-11-02
OSVopenSUSE-SU-2026:11439-1 No score

corepack24-24.18.1-1.1 on GA media

These are all security issues fixed in the corepack24-24.18.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11439-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11440-1 No score

nodejs26-26.5.1-1.1 on GA media

These are all security issues fixed in the nodejs26-26.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11440-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21545-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
openSUSE-SU-2026:21545-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21546-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
openSUSE-SU-2026:21546-1
Updated
2026-11-02
OSVSUSE-SU-2026:23130-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23130-1
Updated
2026-11-02
OSVSUSE-SU-2026:23131-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23131-1
Updated
2026-11-02
OSVSUSE-SU-2026:23154-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23154-1
Updated
2026-11-02
OSVSUSE-SU-2026:23155-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:23155-1
Updated
2026-11-02
OSVSUSE-SU-2026:3520-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues:

Update to 24.18.1.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58041: node:sqlite SQLTagStore iterator replay can re-execute writes (bsc#1272946).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

Other updates and bugfixes:

  • Version 24.18.0:
    • fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
Record
SUSE-SU-2026:3520-1
Updated
2026-11-02
OSVSUSE-SU-2026:3521-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:3521-1
Updated
2026-11-02
OSVSUSE-SU-2026:3557-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:3557-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.21
 before 22.23.2-r0
22.23.2-r0
nodejs
Alpine:v3.22
 before 22.23.2-r0
22.23.2-r0
nodejs
Alpine:v3.23
 before 24.18.1-r0
24.18.1-r0
nodejs
Alpine:v3.24
 before 24.18.1-r0
24.18.1-r0
nodejs-current
Alpine:v3.24
 before 26.5.1-r0
26.5.1-r0
nodejs
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
Show 204 moreShow less
Affected packages
PackageAffectedFixed
nodejs-npm
AlmaLinux:10
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.el10_2
1:10.9.8-1.22.23.2.1.el10_2
nodejs24
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.el10_2
1:11.17.0-1.24.19.0.1.el10_2
nodejs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el9.8.0+302+959ebcd4
1:22.23.2-1.module_el9.8.0+302+959ebcd4
nodejs-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el9.8.0+302+959ebcd4
1:22.23.2-1.module_el9.8.0+302+959ebcd4
nodejs-docs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el9.8.0+302+959ebcd4
1:22.23.2-1.module_el9.8.0+302+959ebcd4
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el9.8.0+302+959ebcd4
1:22.23.2-1.module_el9.8.0+302+959ebcd4
nodejs-libs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el9.8.0+302+959ebcd4
1:22.23.2-1.module_el9.8.0+302+959ebcd4
nodejs-nodemon
AlmaLinux:9
From an advisory covering 10 CVEs
 before 3.1.14-2.module_el9.8.0+291+0bb98cce
3.1.14-2.module_el9.8.0+291+0bb98cce
nodejs-packaging
AlmaLinux:9
From an advisory covering 10 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 10 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4
1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4
v8-12.4-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4
3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4
nodejs
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el9.8.0+301+084fac05
1:24.19.0-1.module_el9.8.0+301+084fac05
nodejs-devel
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el9.8.0+301+084fac05
1:24.19.0-1.module_el9.8.0+301+084fac05
nodejs-docs
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el9.8.0+301+084fac05
1:24.19.0-1.module_el9.8.0+301+084fac05
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el9.8.0+301+084fac05
1:24.19.0-1.module_el9.8.0+301+084fac05
nodejs-libs
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el9.8.0+301+084fac05
1:24.19.0-1.module_el9.8.0+301+084fac05
nodejs-nodemon
AlmaLinux:9
From an advisory covering 11 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 11 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 11 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.module_el9.8.0+301+084fac05
1:11.17.0-1.24.19.0.1.module_el9.8.0+301+084fac05
v8-13.6-devel
AlmaLinux:9
From an advisory covering 11 CVEs
 before 3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05
3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05
nodejs
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el8.10.0+4265+75d28086
1:22.23.2-1.module_el8.10.0+4265+75d28086
nodejs-devel
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el8.10.0+4265+75d28086
1:22.23.2-1.module_el8.10.0+4265+75d28086
nodejs-docs
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el8.10.0+4265+75d28086
1:22.23.2-1.module_el8.10.0+4265+75d28086
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el8.10.0+4265+75d28086
1:22.23.2-1.module_el8.10.0+4265+75d28086
nodejs-libs
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module_el8.10.0+4265+75d28086
1:22.23.2-1.module_el8.10.0+4265+75d28086
nodejs-nodemon
AlmaLinux:8
From an advisory covering 10 CVEs
 before 3.1.14-2.module_el8.10.0+4252+aedd4c30
3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
AlmaLinux:8
From an advisory covering 10 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 10 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086
1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086
v8-12.4-devel
AlmaLinux:8
From an advisory covering 10 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086
3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086
nodejs
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
nodejs-devel
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
nodejs-docs
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
nodejs-libs
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
nodejs-nodemon
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 11 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 11 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
1:11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
v8-13.6-devel
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3:13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
3:13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
nodejs
Azure Linux:3
 before 24.18.1-1
24.18.1-1
nodejs
Alpaquita:25
 22.16.0-r1 up to 22.23.2-r0
22.23.2-r0
nodejs
Alpaquita:stream
 18.16.1-r0 up to 24.18.1-r0
24.18.1-r0
nodejs
BellSoft Hardened Containers:25
 22.16.0-r1 up to 22.23.2-r0
22.23.2-r0
nodejs
BellSoft Hardened Containers:stream
 18.16.1-r0 up to 24.18.1-r0
24.18.1-r0
node
Bitnami
 before 22.23.2, 23.0.0 up to 24.18.1, 25.0.0 up to 26.5.1
22.23.224.18.126.5.1
node-min
Bitnami
 before 22.23.2, 23.0.0 up to 24.18.1, 25.0.0 up to 26.5.1
22.23.224.18.126.5.1
nodejs
Debian:13
 before 20.19.2+dfsg-1+deb13u3, plus listed versions
20.19.2+dfsg-120.19.2+dfsg-1+deb13u120.19.2+dfsg-1+deb13u2
20.19.2+dfsg-1+deb13u3
nodejs
Debian:14
 before 24.19.0+dfsg+~cs24.13.3-1, plus listed versions
20.19.2+dfsg-120.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-120.19.5+dfsg+~cs20.19.12-220.19.5+dfsg+~cs20.19.12-3
Show 35 moreShow less
20.19.5+dfsg+~cs20.19.12-420.19.5+dfsg+~cs20.19.24-122.12.0+dfsg-122.12.0+dfsg-222.12.0+dfsg-322.14.0+dfsg-122.18.0+dfsg+~cs22.17.2-122.18.0+dfsg+~cs22.17.2-222.18.0+dfsg-122.19.0+dfsg+~cs22.18.0-122.21.1+dfsg+~cs22.19.0-122.21.1+dfsg+~cs22.19.0-222.21.1+dfsg+~cs22.19.0-322.21.1+dfsg+~cs22.19.0-422.21.1+dfsg+~cs22.19.0-522.21.1+dfsg+~cs22.19.0-622.22.0+dfsg+~cs22.19.13-122.22.0+dfsg+~cs22.19.13-222.22.0+dfsg+~cs22.19.6-122.22.1+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-324.11.1+dfsg+~cs24.10.1-124.11.1+dfsg+~cs24.10.1-224.12.0+dfsg+~cs24.10.4-124.13.0+dfsg+~cs24.10.7-124.13.0+dfsg+~cs24.10.7-224.14.0+dfsg+~cs24.12.0-124.14.0+dfsg+~cs24.12.0-224.14.1+dfsg+~cs24.12.0-124.15.0+dfsg+~cs24.12.2-124.16.0+dfsg+~cs24.13.1-124.16.0+dfsg+~cs24.13.1-224.17.0+dfsg+~cs24.13.2-124.18.0+dfsg+~cs24.13.2-1
24.19.0+dfsg+~cs24.13.3-1
nodejs
Mageia:10
From an advisory covering 10 CVEs
 before 22.23.2-1.mga10
22.23.2-1.mga10
nodejs
Mageia:9
From an advisory covering 10 CVEs
 before 22.23.2-1.mga9
22.23.2-1.mga9
nodejs26
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.17.0-1.26.5.1.1.5.hum1
0:11.17.0-1.26.5.1.1.5.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.5.1-1.5.hum1
0:26.5.1-1.5.hum1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:10.9.8-1.22.23.2.2.3.hum1
0:10.9.8-1.22.23.2.2.3.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:22.23.2-2.3.hum1
0:22.23.2-2.3.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:11.16.0-1.24.18.1.0.1.hum1
0:11.16.0-1.24.18.1.0.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 15 CVEs
 before 0:24.18.1-0.1.hum1
0:24.18.1-0.1.hum1
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.el10_2
1:10.9.8-1.22.23.2.1.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 10 CVEs
 before 1:22.23.2-1.el10_2
1:22.23.2-1.el10_2
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:24.19.0-1.el10_2
1:24.19.0-1.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.el10_2
1:11.17.0-1.24.19.0.1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el9.8.0+24709+804d6b5b
1:22.23.2-1.module+el9.8.0+24709+804d6b5b
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:3.1.14-2.module+el9.8.0+24709+804d6b5b
0:3.1.14-2.module+el9.8.0+24709+804d6b5b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
1:10.9.8-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
3:12.4.254.21-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
1:11.17.0-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 3:13.6.233.17-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
3:13.6.233.17-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
1:10.9.8-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
3:12.4.254.21-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:24.19.0-1.module+el8.10.0+24711+b610b202
1:24.19.0-1.module+el8.10.0+24711+b610b202
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.1.14-2.module+el8.10.0+24711+b610b202
0:3.1.14-2.module+el8.10.0+24711+b610b202
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 1:11.17.0-1.24.19.0.1.module+el8.10.0+24711+b610b202
1:11.17.0-1.24.19.0.1.module+el8.10.0+24711+b610b202
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 3:13.6.233.17-1.24.19.0.1.module+el8.10.0+24711+b610b202
3:13.6.233.17-1.24.19.0.1.module+el8.10.0+24711+b610b202
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:10.9.8-1.22.23.2.1.el10_0
1:10.9.8-1.22.23.2.1.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 12 CVEs
 before 24.18.1-150700.15.16.1
24.18.1-150700.15.16.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 11 CVEs
 before 22.23.2-150600.13.24.1
22.23.2-150600.13.24.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 11 CVEs
 before 22.23.2-150600.13.24.1
22.23.2-150600.13.24.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 11 CVEs
 before 22.23.2-150700.3.18.1
22.23.2-150700.3.18.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 7 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2
 None known
nodejs
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 7 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm24.2.6~dfsg-1ubuntu4.2+esm3
 None known
nodejs
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 10 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm48.10.0~dfsg-2ubuntu0.4+esm58.10.0~dfsg-2ubuntu0.4+esm6
 None known
nodejs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.1
Show 5 moreShow less
10.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.310.19.0~dfsg-3ubuntu1.510.19.0~dfsg-3ubuntu1.610.19.0~dfsg-3ubuntu1.6+esm2
 None known
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
nodejs
Ubuntu:24.04:LTS
 All versions, plus listed versions
18.13.0+dfsg1-1ubuntu218.19.1+dfsg-2ubuntu418.19.1+dfsg-6ubuntu118.19.1+dfsg-6ubuntu218.19.1+dfsg-6ubuntu5
 None known
nodejs
Ubuntu:26.10
 All versions, plus listed versions
22.22.1+dfsg+~cs22.19.15-1ubuntu124.16.0+dfsg+~cs24.13.1-2ubuntu124.18.0+dfsg+~cs24.13.2-1ubuntu124.19.0+dfsg+~cs24.13.3-1ubuntu1
 None known
nodejs
Ubuntu:26.04:LTS
 All versions, plus listed versions
20.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-422.21.1+dfsg+~cs22.19.0-6ubuntu422.22.0+dfsg+~cs22.19.6-1ubuntu222.22.0+dfsg+~cs22.19.13-2ubuntu122.22.1+dfsg+~cs22.19.15-1ubuntu1
 None known
nodejs24
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 24.18.1-1.1
24.18.1-1.1
nodejs26
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 26.5.1-1.1
26.5.1-1.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 22.23.2-160000.1.1
22.23.2-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 12 CVEs
 before 24.18.1-160000.1.1
24.18.1-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCompleteTech-Security/node-cve-2026-56847-check2026-10-23

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected, aliases, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56847 is a low vulnerability (CVSS 3.3) in Nodejs Node, published July 30, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in nodejs 22.23.2-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 45 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open