Every CVE Search/ Get API key

CVE-2026-69192

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

7.7 HighFix available

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.46%Up 0.2 points since Aug 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
CVE-2026-69192
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
EUVDEUVD-2026-52419 7.7

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
EUVD-2026-52419
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mwp4-54f8-5fhr 7.7

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary

Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.

An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.

Details

Address4.parse gates untrusted input on RE_ADDRESS (src/v4/constants.ts:5), whose per-octet alternative is:

(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

The [01]?[0-9][0-9]? branch matches a leading zero, so 012 passes validation. Every downstream decode then reads the octet with parseInt(part, 10) (src/common.ts:87), yielding 12. A resolver reading the same string treats the leading 0 as base 8 and yields 10.

The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets.

Address6 already rejects this notation on its IPv4-in-IPv6 path, throwing "IPv4 addresses can't have leading zeroes." (src/ipv6.ts:751-762), so Address4 is the outlier within the library.

Affected versions

<= 10.3.0. Unlike GHSA-22jq-vg5j-6vgg and GHSA-4xrf-jv44-h6hh, which were bounded below by the is* classification API introduced in 10.1.1, this defect is in parse and reaches every release: a guard built on isInSubnet() against the RFC 1918 ranges is affected in versions predating that API.

Impact

The disagreement runs in both directions. Under-blocking is the security-relevant case; over-blocking is a correctness and availability problem.

| Input | correctForm() | Classified as | Resolver reaches | Effect | |---|---|---|---|---| | 012.0.0.1 | 12.0.0.1 | public | 10.0.0.1 | internal target allowed | | 012.012.012.012 | 12.12.12.12 | public | 10.10.10.10 | internal target allowed | | 010.0.0.1 | 10.0.0.1 | private | 8.0.0.1 | public target blocked |

Reachable targets are those whose leading octet is expressible as a three-character octal literal, which covers the whole of 10.0.0.0/8 and 0.0.0.0/8. A four-character octet such as 0177 for 127 is rejected by the regex, so loopback is not reachable through this path; see the note on rejection below for why rejection is not the same as safety.

Reachability

A leading-zero address is a legal URL host, so this is reachable through the ordinary URL path with no unusual application shape required:

new URL('http://012.0.0.1/').hostname   // '10.0.0.1'

This distinguishes it from GHSA-4xrf-jv44-h6hh, where the /0 CIDR suffix could not survive URL parsing and exploitation therefore required an application that accepted a bare suffix-bearing string. Here the attack rides the same code path a normal user-supplied URL takes.

Proof of concept

npm i [email protected], then:

const { Address4 } = require('ip-address');

// A guard of the shape the library documents.
function isBlocked(host) {
  return Address4.isValid(host) && new Address4(host).isPrivate();
}

for (const h of ['10.0.0.1', '012.0.0.1', '012.012.012.012']) {
  console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h,
              '-> resolver reaches', new URL('http://' + h + '/').hostname);
}

On affected versions:

BLOCK 10.0.0.1 -> resolver reaches 10.0.0.1
ALLOW 012.0.0.1…
Record
GHSA-mwp4-54f8-5fhr
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
NVD 7.7

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
CVE-2026-69192
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSV 7.7

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
CVE-2026-69192
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSVDEBIAN-CVE-2026-69192 7.7

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
DEBIAN-CVE-2026-69192
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 34 moreShow less
OSVGHSA-mwp4-54f8-5fhr 7.7

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary

Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.

An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.

Details

Address4.parse gates untrusted input on RE_ADDRESS (src/v4/constants.ts:5), whose per-octet alternative is:

(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

The [01]?[0-9][0-9]? branch matches a leading zero, so 012 passes validation. Every downstream decode then reads the octet with parseInt(part, 10) (src/common.ts:87), yielding 12. A resolver reading the same string treats the leading 0 as base 8 and yields 10.

The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets.

Address6 already rejects this notation on its IPv4-in-IPv6 path, throwing "IPv4 addresses can't have leading zeroes." (src/ipv6.ts:751-762), so Address4 is the outlier within the library.

Affected versions

<= 10.3.0. Unlike GHSA-22jq-vg5j-6vgg and GHSA-4xrf-jv44-h6hh, which were bounded below by the is* classification API introduced in 10.1.1, this defect is in parse and reaches every release: a guard built on isInSubnet() against the RFC 1918 ranges is affected in versions predating that API.

Impact

The disagreement runs in both directions. Under-blocking is the security-relevant case; over-blocking is a correctness and availability problem.

| Input | correctForm() | Classified as | Resolver reaches | Effect | |---|---|---|---|---| | 012.0.0.1 | 12.0.0.1 | public | 10.0.0.1 | internal target allowed | | 012.012.012.012 | 12.12.12.12 | public | 10.10.10.10 | internal target allowed | | 010.0.0.1 | 10.0.0.1 | private | 8.0.0.1 | public target blocked |

Reachable targets are those whose leading octet is expressible as a three-character octal literal, which covers the whole of 10.0.0.0/8 and 0.0.0.0/8. A four-character octet such as 0177 for 127 is rejected by the regex, so loopback is not reachable through this path; see the note on rejection below for why rejection is not the same as safety.

Reachability

A leading-zero address is a legal URL host, so this is reachable through the ordinary URL path with no unusual application shape required:

new URL('http://012.0.0.1/').hostname   // '10.0.0.1'

This distinguishes it from GHSA-4xrf-jv44-h6hh, where the /0 CIDR suffix could not survive URL parsing and exploitation therefore required an application that accepted a bare suffix-bearing string. Here the attack rides the same code path a normal user-supplied URL takes.

Proof of concept

npm i [email protected], then:

const { Address4 } = require('ip-address');

// A guard of the shape the library documents.
function isBlocked(host) {
  return Address4.isValid(host) && new Address4(host).isPrivate();
}

for (const h of ['10.0.0.1', '012.0.0.1', '012.012.012.012']) {
  console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h,
              '-> resolver reaches', new URL('http://' + h + '/').hostname);
}

On affected versions:

BLOCK 10.0.0.1 -> resolver reaches 10.0.0.1
ALLOW 012.0.0.1…
Record
GHSA-mwp4-54f8-5fhr
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-20, CWE-918
Updated
2026-11-02
OSVRHSA-2026:50826 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:50826
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:50854 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:50854
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:50956 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:50956
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:50969 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:50969
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:54371 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:54530 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:54530
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55541 8.6

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:55541
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55601 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:55601
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55603 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:57590 8.6

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Record
RHSA-2026:57590
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:58819 8.6

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:62416 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:62416
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:64817 8.6

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:64817
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:54371 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:54530 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54530
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55541 8.6

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55541
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55601 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55601
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55603 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:58819 8.6

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-69192 7.7

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Record
UBUNTU-CVE-2026-69192
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:54371 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54371
Updated
2026-11-02
OSVALSA-2026:54530 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54530
Updated
2026-11-02
OSVALSA-2026:55541 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55541
Updated
2026-11-02
OSVALSA-2026:55601 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55601
Updated
2026-11-02
OSVALSA-2026:55603 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55603
Updated
2026-11-02
OSVALSA-2026:58819 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:58819
Updated
2026-11-02
OSVCLSA-2026-1788560487 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.1.

Record
CLSA-2026-1788560487
Updated
2026-11-02
OSVCLSA-2026-1790604982 No score

TuxCare security update for ip-address (2 CVEs)

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 7.1.0-tuxcare.1.

Record
CLSA-2026-1790604982
Updated
2026-11-02
OSVCLSA-2026-1792451467 No score

TuxCare security update for ip-address (6 CVEs)

TuxCare rebuilt ip-address to address 6 CVEs. Fixed in 10.1.1-tuxcare.1.

Record
CLSA-2026-1792451467
Updated
2026-11-02
OSVCLSA-2026-1792476227 No score

TuxCare security update for ip-address (7 CVEs)

TuxCare rebuilt ip-address to address 7 CVEs. Fixed in 10.1.0-tuxcare.1.

Record
CLSA-2026-1792476227
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-69192 No score

CVE-2026-69192 in ip-address - Patched by Root

Root has patched CVE-2026-69192 in the ip-address package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-69192
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ip-address
npm
 through 10.3.0
10.3.1
nodejs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-docs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-libs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
Show 192 moreShow less
Affected packages
PackageAffectedFixed
v8-13.6-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
nodejs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-docs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-libs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-nodemon
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.1.14-2.module_el8.10.0+4252+aedd4c30
3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
v8-12.4-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
nodejs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.9.8-1.22.23.1.6.el10_2
1:10.9.8-1.22.23.1.6.el10_2
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el9.8.0+291+0bb98cce
3.1.14-2.module_el9.8.0+291+0bb98cce
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
v8-12.4-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
v8-13.6-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
nodejs24
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
ip-address
TuxCare:npm
 6.4.0-tuxcare.0 up to 6.4.0-tuxcare.1, plus listed versions
6.4.0
6.4.0-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 2 CVEs
 7.1.0-tuxcare.0 up to 7.1.0-tuxcare.1, plus listed versions
7.1.0
7.1.0-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.1-tuxcare.0 up to 10.1.1-tuxcare.1, plus listed versions
10.1.1
10.1.1-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.0-tuxcare.0 up to 10.1.0-tuxcare.1, plus listed versions
10.1.0
10.1.0-tuxcare.1
node-ip-address
Debian:12
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:13
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:14
 before 10.3.1-1, plus listed versions
10.2.0-110.2.0-28.1.0-28.1.0-3
10.3.1-1
ip-address
npm
 before 10.3.1
10.3.1
grafana13.1
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:13.1.1-0.5.2.hum1
0:13.1.1-0.5.2.hum1
grafana12.4
Red Hat:hummingbird:1
 before 0:12.4.6-0.4.1.hum1
0:12.4.6-0.4.1.hum1
grafana13.1
Red Hat:hummingbird:1
 before 0:13.1.2-0.1.hum1
0:13.1.2-0.1.hum1
grafana12.4
Red Hat:hummingbird:1
 before 0:12.4.7-0.1.hum1
0:12.4.7-0.1.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+24639+56878497
0:3.1.14-2.module+el8.10.0+24639+56878497
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+24640+6eba5e6e
0:3.1.14-2.module+el8.10.0+24640+6eba5e6e
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:10.9.8-1.22.23.1.6.el10_2
1:10.9.8-1.22.23.1.6.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el9.8.0+24637+e0b636e5
0:3.1.14-2.module+el9.8.0+24637+e0b636e5
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+24638+75f46aee
0:3.1.14-3.module+el9.8.0+24638+75f46aee
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
rh-podman-desktop
Red Hat:enterprise_linux:10.2
From an advisory covering 24 CVEs
 before 0:1.1.2-1.el10_2
0:1.1.2-1.el10_2
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:10.9.8-1.22.23.2.1.el10_0
1:10.9.8-1.22.23.2.1.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs
Rocky Linux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs
Rocky Linux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+40278+50b003a3
1:22.23.1-3.module+el8.10.0+40278+50b003a3
nodejs-nodemon
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs22
Rocky Linux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs
Rocky Linux:9
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el9.8.0+40280+057606e8
1:22.23.1-3.module+el9.8.0+40280+057606e8
nodejs-nodemon
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-nodemon
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el9.8.0+40280+057606e8
0:3.1.14-2.module+el9.8.0+40280+057606e8
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs
Rocky Linux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+40281+14cc6568
1:24.18.0-6.module+el9.8.0+40281+14cc6568
nodejs-nodemon
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs24
Rocky Linux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
ip-address
Root:npm
 before 10.2.0-aikido.1
10.2.0-aikido.110.1.0-aikido.39.0.5-aikido.410.2.0-aikido.210.0.1-aikido.3
@rootio/ip-address
Root:npm
 before 10.2.0-root.io.1
10.2.0-root.io.110.1.0-root.io.39.0.5-root.io.410.2.0-root.io.210.0.1-root.io.3
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
node-ip-address
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.3.0-1
 None known
node-ip-address
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.0-18.1.0-2
 None known
node-ip-address
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.1.0-2
 None known
node-ip-address
Ubuntu:26.10
 All versions, plus listed versions
8.1.0-310.2.0-210.3.1-110.4.0-1
 None known
node-ip-address
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.1.0-28.1.0-3
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-69192 is a high vulnerability (CVSS 7.7) in Beaugunderson Ip-address, published August 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in ip-address 10.3.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 188 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open