Every CVE Search/ Get API key

CVE-2026-9496

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

8.7 HighFix available

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.35%Up 0.3 points since May 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
CVE-2026-9496
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
EUVDEUVD-2026-31793 8.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
EUVD-2026-31793
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-w4pp-8pjf-rmxw 7.7

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
GHSA-w4pp-8pjf-rmxw
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 7.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
CVE-2026-9496
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSV 7.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
CVE-2026-9496
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2026-9496 7.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
DEBIAN-CVE-2026-9496
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 39 moreShow less
OSVGHSA-w4pp-8pjf-rmxw 7.7

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
GHSA-w4pp-8pjf-rmxw
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVRHSA-2026:72116 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:72116
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:72497 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:72497
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:75864 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:75864
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:75870 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:75870
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:76750 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:76750
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:84589 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:84589
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:84703 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:84703
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:75864 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:75864
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:75870 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:75870
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:76750 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:76750
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-9496 7.7

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Record
UBUNTU-CVE-2026-9496
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:75864 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:75864
Updated
2026-11-02
OSVALSA-2026:75870 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:75870
Updated
2026-11-02
OSVALSA-2026:76750 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:76750
Updated
2026-11-02
OSVCLSA-2026-1787859798 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 20.0.0-tuxcare.1.

Record
CLSA-2026-1787859798
Updated
2026-11-02
OSVCLSA-2026-1787916402 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 18.0.6-tuxcare.1.

Record
CLSA-2026-1787916402
Updated
2026-11-02
OSVCLSA-2026-1788781526 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 20.0.1-tuxcare.1.

Record
CLSA-2026-1788781526
Updated
2026-11-02
OSVCLSA-2026-1790108841 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 17.0.7-tuxcare.1.

Record
CLSA-2026-1790108841
Updated
2026-11-02
OSVCLSA-2026-1790171653 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.5.0-tuxcare.1.

Record
CLSA-2026-1790171653
Updated
2026-11-02
OSVCLSA-2026-1790190327 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.0.4-tuxcare.1.

Record
CLSA-2026-1790190327
Updated
2026-11-02
OSVCLSA-2026-1790201054 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.0.1-tuxcare.1.

Record
CLSA-2026-1790201054
Updated
2026-11-02
OSVCLSA-2026-1790673431 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 19.0.2-tuxcare.1.

Record
CLSA-2026-1790673431
Updated
2026-11-02
OSVCLSA-2026-1791840472 No score

nodejs: Fix of CVE-2026-9496

  • CVE-2026-9496: strip the committish in addGitSha() of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU
Record
CLSA-2026-1791840472
Updated
2026-11-02
OSVCLSA-2026-1791841538 No score

nodejs: Fix of CVE-2026-9496

  • CVE-2026-9496: strip the committish in addGitSha() of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU
Record
CLSA-2026-1791841538
Updated
2026-11-02
OSVCLSA-2026-1792163599 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.0.3-tuxcare.1.

Record
CLSA-2026-1792163599
Updated
2026-11-02
OSVCLSA-2026-1792475534 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 12.0.2-tuxcare.1.

Record
CLSA-2026-1792475534
Updated
2026-11-02
OSVCLSA-2026-1792493763 No score

TuxCare security update for pacote (1 CVE)

TuxCare rebuilt pacote to address 1 CVE. Fixed in 12.0.3-tuxcare.1.

Record
CLSA-2026-1792493763
Updated
2026-11-02
OSVopenSUSE-SU-2026:11121-1 No score

corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11121-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21058-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
openSUSE-SU-2026:21058-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21236-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
openSUSE-SU-2026:21236-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-9496 No score

CVE-2026-9496 in pacote - Patched by Root

Root has patched CVE-2026-9496 in the pacote package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-9496
Updated
2026-11-02
OSVSUSE-SU-2026:22368-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
  • CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:22368-1
Updated
2026-11-02
OSVSUSE-SU-2026:22565-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to version 24.18.0 (bsc#1269825).

Security issues fixed:

  • CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).

Other updates and bugfixes:

  • Version 24.18.0:
    • doc: update blockList stability status to release candidate
    • fs: support caller-supplied readFile() buffers
    • http: close pre-request sockets in closeIdleConnections
    • loader: implement package maps
    • net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    • tls: add certificateCompression option
    • vfs: dispatch node:fs/promises to mounted VFS instances
    • vfs: add minimal node:vfs subsystem
  • For changes in older versions, see https://github.com/nodejs/node/releases.
  • Remove update-alternatives from scriptlets if not available.
  • Explicitly BuildRequire update-alternatives and mark it as being used in post/postun.
  • Add -fno-lifetime-dse to CXXFLAGS to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.
Record
SUSE-SU-2026:22565-1
Updated
2026-11-02
OSVSUSE-SU-2026:2633-1 No score

Security update for nodejs24

This update for nodejs24 fixes the following issues

Update to 24.17.0:

  • CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2633-1
Updated
2026-11-02
OSVSUSE-SU-2026:2647-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues

Update to 22.23.0:

  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
Record
SUSE-SU-2026:2647-1
Updated
2026-11-02
OSVSUSE-SU-2026:2695-1 No score

Security update for nodejs22

This update for nodejs22 fixes the following issues:

  • CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
  • CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
  • CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
  • CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
  • CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
  • CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
  • CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
  • CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
  • CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
  • CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
  • CVE-2026-48937: http2: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).
  • CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).
  • CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec ( bsc#1266318).
  • CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
Record
SUSE-SU-2026:2695-1
Updated
2026-11-02
OSVSUSE-SU-2026:3929-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3929-1
Updated
2026-11-02
OSVSUSE-SU-2026:3930-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

  • CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9496: pacote: excessive CPU consumption in addGitSha when processing a specially crafted spec.rawSpec value can lead to DoS (bsc#1266318).
  • CVE-2026-9679: undici: HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
  • CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).
  • CVE-2026-48615: proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
  • CVE-2026-48617: permission model enforcement bypass via process.report.writeReport() path misvalidation (bsc#1268554).
  • CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: permission model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).
  • CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
  • CVE-2026-69192: ip-address: Address4…
Record
SUSE-SU-2026:3930-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
pacote
npm
 11.2.7 up to 21.5.1
21.5.1
nodejs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.3.el10_2
1:10.9.8-1.22.23.2.3.el10_2
nodejs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-docs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
Show 149 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-libs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.1.14-2.module_el8.10.0+4252+aedd4c30
3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
v8-12.4-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
nodejs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-docs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-libs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module_el9.8.0+322+f4aa738c
1:22.23.2-2.module_el9.8.0+322+f4aa738c
nodejs-nodemon
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.1.14-2.module_el9.8.0+302+959ebcd4
3.1.14-2.module_el9.8.0+302+959ebcd4
nodejs-packaging
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
v8-12.4-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c
3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c
pacote
TuxCare:npm
 20.0.0-tuxcare.0 up to 20.0.0-tuxcare.1, plus listed versions
20.0.0
20.0.0-tuxcare.1
pacote
TuxCare:npm
 18.0.6-tuxcare.0 up to 18.0.6-tuxcare.1, plus listed versions
18.0.6
18.0.6-tuxcare.1
pacote
TuxCare:npm
 20.0.1-tuxcare.0 up to 20.0.1-tuxcare.1, plus listed versions
20.0.1
20.0.1-tuxcare.1
pacote
TuxCare:npm
 17.0.7-tuxcare.0 up to 17.0.7-tuxcare.1, plus listed versions
17.0.7
17.0.7-tuxcare.1
pacote
TuxCare:npm
 21.5.0-tuxcare.0 up to 21.5.0-tuxcare.1, plus listed versions
21.5.0
21.5.0-tuxcare.1
pacote
TuxCare:npm
 21.0.4-tuxcare.0 up to 21.0.4-tuxcare.1, plus listed versions
21.0.4
21.0.4-tuxcare.1
pacote
TuxCare:npm
 21.0.1-tuxcare.0 up to 21.0.1-tuxcare.1, plus listed versions
21.0.1
21.0.1-tuxcare.1
pacote
TuxCare:npm
 19.0.2-tuxcare.0 up to 19.0.2-tuxcare.1, plus listed versions
19.0.2
19.0.2-tuxcare.1
nodejs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-8.el9_2.tuxcare.els22
1:16.20.2-8.el9_2.tuxcare.els22
nodejs-devel
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-8.el9_2.tuxcare.els22
1:16.20.2-8.el9_2.tuxcare.els22
nodejs-docs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-8.el9_2.tuxcare.els22
1:16.20.2-8.el9_2.tuxcare.els22
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-8.el9_2.tuxcare.els22
1:16.20.2-8.el9_2.tuxcare.els22
nodejs-libs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-8.el9_2.tuxcare.els22
1:16.20.2-8.el9_2.tuxcare.els22
npm
TuxCare:AlmaLinux:9.2
 before 1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els22
1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els22
v8-devel
TuxCare:AlmaLinux:9.2
 before 2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els22
2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els22
nodejs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els22
1:16.20.2-8.el9_6.tuxcare.els22
nodejs-devel
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els22
1:16.20.2-8.el9_6.tuxcare.els22
nodejs-docs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els22
1:16.20.2-8.el9_6.tuxcare.els22
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els22
1:16.20.2-8.el9_6.tuxcare.els22
nodejs-libs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els22
1:16.20.2-8.el9_6.tuxcare.els22
npm
TuxCare:AlmaLinux:9.6
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els22
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els22
v8-devel
TuxCare:AlmaLinux:9.6
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els22
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els22
pacote
TuxCare:npm
 21.0.3-tuxcare.0 up to 21.0.3-tuxcare.1, plus listed versions
21.0.3
21.0.3-tuxcare.1
pacote
TuxCare:npm
 12.0.2-tuxcare.0 up to 12.0.2-tuxcare.1, plus listed versions
12.0.2
12.0.2-tuxcare.1
pacote
TuxCare:npm
 12.0.3-tuxcare.0 up to 12.0.3-tuxcare.1, plus listed versions
12.0.3
12.0.3-tuxcare.1
npm
Debian:12
 All versions, plus listed versions
11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1
Show 16 moreShow less
11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-112.0.2+ds1-112.0.2+ds1-29.2.0~ds1-19.2.0~ds1-29.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1
 None known
npm
Debian:13
 All versions, plus listed versions
11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1
Show 14 moreShow less
11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-112.0.2+ds1-112.0.2+ds1-29.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1
 None known
npm
Debian:14
 before 12.0.2+ds1-1, plus listed versions
11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1
Show 12 moreShow less
11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-19.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1
12.0.2+ds1-1
grafana12.4
Red Hat:hummingbird:1
 before 0:12.4.10-0.8.hum1
0:12.4.10-0.8.hum1
grafana12.4
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:12.4.10-0.9.hum1
0:12.4.10-0.9.hum1
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.3.el10_2
1:10.9.8-1.22.23.2.3.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el8.10.0+24957+74108fbf
1:22.23.2-2.module+el8.10.0+24957+74108fbf
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf
1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf
3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
1:22.23.2-2.module+el9.8.0+24958+80b2ac6e
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+24709+804d6b5b
0:3.1.14-2.module+el9.8.0+24709+804d6b5b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.6.0+25055+19201b10
1:22.23.2-2.module+el9.6.0+25055+19201b10
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10
1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10
3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:10.9.8-1.22.23.2.2.el10_0
1:10.9.8-1.22.23.2.2.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 1:22.23.2-2.el10_0
1:22.23.2-2.el10_0
nodejs22
Rocky Linux:10
From an advisory covering 2 CVEs
 before 1:22.23.2-3.el10_2
1:22.23.2-3.el10_2
nodejs-nodemon
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs
Rocky Linux:9
From an advisory covering 2 CVEs
 before 1:22.23.2-2.module+el9.8.0+40374+17512296
1:22.23.2-2.module+el9.8.0+40374+17512296
nodejs-nodemon
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+40280+057606e8
0:3.1.14-2.module+el9.8.0+40280+057606e8
nodejs-nodemon
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
pacote
Root:npm
 before 21.4.0-aikido.1
21.4.0-aikido.111.3.5-aikido.121.0.3-aikido.121.5.0-aikido.120.0.0-aikido.119.0.1-aikido.113.6.2-aikido.121.0.0-aikido.119.0.2-aikido.120.0.1-aikido.118.0.6-aikido.115.1.3-aikido.117.0.4-aikido.117.0.6-aikido.121.1.0-aikido.1
@rootio/pacote
Root:npm
 before 21.4.0-root.io.1
21.4.0-root.io.121.0.3-root.io.111.3.5-root.io.121.5.0-root.io.120.0.0-root.io.119.0.1-root.io.113.6.2-root.io.121.0.0-root.io.119.0.2-root.io.120.0.1-root.io.118.0.6-root.io.115.1.3-root.io.117.0.4-root.io.117.0.6-root.io.121.1.0-root.io.1
nodejs22
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs22
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1
nodejs24
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 21 CVEs
 before 24.17.0-150700.15.11.1
24.17.0-150700.15.11.1
nodejs22
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 22.23.0-150600.13.18.1
22.23.0-150600.13.18.1
nodejs22
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 19 CVEs
 before 22.23.0-150700.3.12.1
22.23.0-150700.3.12.1
nodejs20
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 35 CVEs
 before 20.20.2-150600.3.21.1
20.20.2-150600.3.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 35 CVEs
 before 20.20.2-150500.11.30.1
20.20.2-150500.11.30.1
npm
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.2.18~dfsg-31.3.10~dfsg-1
 None known
npm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.4.21+ds-23.5.2-0ubuntu43.5.2-0ubuntu4.1.16.04.1~esm1
 None known
npm
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.5.2-0ubuntu43.5.2-0ubuntu4.1.18.04.1~esm1
 None known
npm
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.8.0+ds6-46.14.4+ds-1ubuntu2
 None known
npm
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.5.2+ds-27.24.2+ds-17.24.2+ds-28.3.0~ds-18.3.0~ds-28.3.2~ds-18.5.0~ds-18.5.1~ds-1
 None known
npm
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.2.0~ds1-19.2.0~ds1-2
 None known
npm
Ubuntu:25.10
 All versions, plus listed versions
9.2.0~ds1-3
 None known
npm
Ubuntu:26.10
 All versions, plus listed versions
9.2.0~ds3-111.16.0+ds2-4
 None known
npm
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.2.0~ds1-39.2.0~ds2-29.2.0~ds3-1
 None known
nodejs24
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 24.17.0-1.1
24.17.0-1.1
nodejs22
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 22.23.0-160000.1.1
22.23.0-160000.1.1
nodejs24
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 24.18.0-160000.1.1
24.18.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9496 is a high vulnerability (CVSS 8.7) in pacote, published May 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in pacote 21.5.1.

References

Show 155 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open