{"id":"CVE-2025-23166","aliases":["ALPINE-CVE-2025-23166","ALSA-2025:8467","ALSA-2025:8468","ALSA-2025:8493","ALSA-2025:8506","ALSA-2025:8514","AZL-61919","AZL-65066","BELL-CVE-2025-23166","BIT-node-2025-23166","BIT-node-min-2025-23166","CLSA-2025-1753208069","CLSA-2026-1770140451","DEBIAN-CVE-2025-23166","EUVD-2025-15702","GHSA-rrjv-57mm-j6cm","MGASA-2025-0161","OESA-2025-1533","OESA-2025-1534","RHSA-2025:8467","RHSA-2025:8468","RHSA-2025:8493","RHSA-2025:8506","RHSA-2025:8514","RHSA-2025:8902","RLSA-2025:8467","RLSA-2025:8468","RLSA-2025:8493","RLSA-2025:8506","RLSA-2025:8514","ROOT-OS-DEBIAN-12-CVE-2025-23166","SUSE-SU-2025:01878-1","SUSE-SU-2025:01879-1","SUSE-SU-2025:02039-1","SUSE-SU-2025:02045-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1","SUSE-SU-2026:4355-1","UBUNTU-CVE-2025-23166","openSUSE-SU-2025:15250-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00817,"percentile":0.57548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2025-05-16T06:00:00.293226Z","modified":"2026-11-06T10:58:08Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs","fixed_in":["1:22.16.0-1.module_el9.6.0+170+f035de78","1:20.19.2-1.module_el9.6.0+169+c9cb05c2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-devel","fixed_in":["1:22.16.0-1.module_el9.6.0+170+f035de78","1:20.19.2-1.module_el9.6.0+169+c9cb05c2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-docs","fixed_in":["1:22.16.0-1.module_el9.6.0+170+f035de78","1:20.19.2-1.module_el9.6.0+169+c9cb05c2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","fixed_in":["1:22.16.0-1.module_el9.6.0+170+f035de78","1:20.19.2-1.module_el9.6.0+169+c9cb05c2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-libs","fixed_in":["1:22.16.0-1.module_el9.6.0+170+f035de78"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","fixed_in":["3.0.1-1.module_el9.5.0+139+09296491","3.0.1-1.module_el9.5.0+125+8dc38870"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-packaging","fixed_in":["2021.06-4.module_el9.5.0+139+09296491","2021.06-4.module_el9.6.0+162+8dc602e5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","fixed_in":["2021.06-4.module_el9.5.0+139+09296491","2021.06-4.module_el9.6.0+162+8dc602e5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"npm","fixed_in":["1:10.9.2-1.22.16.0.1.module_el9.6.0+170+f035de78","1:10.8.2-1.20.19.2.1.module_el9.6.0+169+c9cb05c2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","fixed_in":["3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-docs","fixed_in":["1:22.16.0-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs","fixed_in":["1:22.16.0-1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-devel","fixed_in":["1:22.16.0-1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-docs","fixed_in":["1:22.16.0-1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","fixed_in":["1:22.16.0-1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-libs","fixed_in":["1:22.16.0-1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","fixed_in":["3.0.1-1.module_el8.10.0+3983+391a1a04"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-packaging","fixed_in":["2021.06-4.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","fixed_in":["2021.06-4.module_el8.10.0+3961+6a788e57"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"npm","fixed_in":["1:10.9.2-1.22.16.0.1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","fixed_in":["3:12.4.254.21-1.22.16.0.1.module_el8.10.0+4006+3c416519"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.3-8"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.19.2","22.15.1","24.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.19.2","22.15.1","24.0.2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["18.20.4+dfsg-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.19.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["20.19.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debuginfo","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debugsource","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-devel","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-docs","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-full-i18n","fixed_in":["1:20.19.2-2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-nodemon","fixed_in":["0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging-bundler","fixed_in":["0:2021.06-4.module+el9.3.0+19518+63aad52d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"npm","fixed_in":["1:10.8.2-1.20.19.2.2.module+el9.4.0+23180+d266bac7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+139+09296491"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.5.0+139+09296491"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el9.6.0+169+c9cb05c2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el9.6.0+169+c9cb05c2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el9.6.0+169+c9cb05c2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el9.6.0+169+c9cb05c2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.5.0+125+8dc38870"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.6.0+162+8dc602e5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.6.0+162+8dc602e5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module_el9.6.0+169+c9cb05c2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3983+391a1a04"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3961+6a788e57"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module_el8.10.0+4006+3c416519"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3982+85c136aa"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3987+dbda4426"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.3-8"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.8-r0"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.7-r0"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.1-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.8-r0"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.7-r0"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.1-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.19.2"},{"introduced":"21.0.0"},{"fixed":"22.15.1"},{"introduced":"23.0.0"},{"fixed":"24.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.19.2"},{"introduced":"21.0.0"},{"fixed":"22.15.1"},{"introduced":"23.0.0"},{"fixed":"24.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4+dfsg-1~deb12u2"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.16.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-3.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-3.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.2.module+el9.4.0+23180+d266bac7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150600.13.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150600.13.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150600.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150600.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23166","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rrjv-57mm-j6cm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-23166","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8467","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23166","tags":["report"]},{"url":"https://bugzilla.redhat.com/2367163","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-8467.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8468","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-8468.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8493","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-8493.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8506","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8506.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8514","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8514.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-23165.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-23167.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-23166","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753208069.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1770140451.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-23166","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0161.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34278","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23165","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1534","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367163","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8467.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23165","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23166","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8468.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23167","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8493.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-91596","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8506.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-89598","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-91595","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8514.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8902","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8902.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8467","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8468","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8493","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8506","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8514","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501878-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239949","tags":["report"]},{"url":"https://bugzilla.suse.com/1241050","tags":["report"]},{"url":"https://bugzilla.suse.com/1243217","tags":["report"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501879-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502045-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1256570","tags":["report"]},{"url":"https://bugzilla.suse.com/1256573","tags":["report"]},{"url":"https://bugzilla.suse.com/1256574","tags":["report"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1272958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264261-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236250","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-23166","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-async-cryptographic-operations-crashes-process-cve-2025-23166---high","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/6c57465920cf1b981a63031e71b1e4a73bf9beaa","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T01:25:08.462Z","modified":"2025-05-28T00:07:12.64Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:32:33.410838Z"}],"euvd":[{"id":"EUVD-2025-15702","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T01:25:08Z","modified":"2025-05-28T00:07:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:37.949923Z"}],"ghsa":[{"id":"GHSA-rrjv-57mm-j6cm","title":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T03:30:29Z","modified":"2025-05-19T15:30:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:02:20.924524Z"}],"nvd":[{"id":"CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17.47Z","modified":"2026-06-17T08:52:18.473Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:11:09.125937Z"}],"osv":[{"id":"ALPINE-CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17.47Z","modified":"2026-08-27T22:18:02.824923973Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-23166","status":"published","published":"2025-05-16T06:00:00.293226Z","modified":"2026-02-18T07:38:17.622469Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"DEBIAN-CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17.47Z","modified":"2026-09-01T20:05:44.492867574Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"OESA-2025-1533","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)\n\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)","status":"published","published":"2025-05-23T11:08:37Z","modified":"2026-08-18T01:17:58.974736289Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1534","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)\n\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)","status":"published","published":"2025-05-23T11:08:37Z","modified":"2026-08-18T01:17:58.888792867Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:8467","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-06-04T10:03:34Z","modified":"2026-08-07T10:20:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8468","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-06-04T10:03:34Z","modified":"2026-08-07T10:20:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8493","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2025-06-04T10:03:39Z","modified":"2026-08-07T10:20:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8506","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-06-05T10:04:30Z","modified":"2026-08-07T10:20:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8514","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-06-05T10:04:31Z","modified":"2026-08-07T10:20:47Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8902","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-06-12T10:03:02Z","modified":"2026-08-07T10:20:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:8467","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:44.777193Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8468","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:44.363123Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8493","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:18:54.771582Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8506","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:11.720979Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8514","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:12.131975Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:00Z","modified":"2026-04-22T15:39:01.018041Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:8467","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-03T00:00:00Z","modified":"2026-10-29T11:32:30.067219233Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8468","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-03T00:00:00Z","modified":"2026-10-29T11:32:29.979735561Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8493","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-04T00:00:00Z","modified":"2026-10-29T11:30:07.423958489Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8506","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-04T00:00:00Z","modified":"2026-10-29T11:02:23.196188608Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8514","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-04T00:00:00Z","modified":"2026-11-06T10:58:08.58351657Z","updated_at":"2026-11-06T11:08:40.431174Z"},{"id":"AZL-61919","title":"CVE-2025-23166 affecting package nodejs for versions less than 20.14.0-9","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-65066","title":"CVE-2025-23166 affecting package nodejs18 for versions less than 18.20.3-8","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17Z","modified":"2026-04-21T04:32:39.790217Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BIT-node-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-21T06:00:25.492Z","modified":"2025-05-21T06:28:28.668756Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-21T06:00:25.504Z","modified":"2025-05-21T06:28:28.668756Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2025-1753208069","title":"nodejs: Fix of CVE-2025-23166","description":"- CVE-2025-23166: src: fix error handling on async crypto operations","status":"published","published":"2025-07-22T18:14:34Z","modified":"2026-06-01T00:30:53.443193414Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1770140451","title":"nodejs: Fix of CVE-2025-23166","description":"- CVE-2025-23166: fix SignTraits::DeriveBits() to properly validate\n  user-supplied inputs to prevent crashing Node.js process","status":"published","published":"2026-02-03T17:40:55Z","modified":"2026-06-01T00:32:40.365333328Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CVE-2025-23166","description":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.","status":"published","published":"2025-05-19T02:15:17Z","modified":"2026-09-29T09:26:39.44648523Z","updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"MGASA-2025-0161","title":"Updated nodejs packages fix security vulnerabilities","description":"Corrupted pointer in node::fs::ReadFileUtf8(const\nFunctionCallbackInfo\u003cValue\u003e\u0026 args) when args[0] is a string.\n(CVE-2025-23165)\nImproper error handling in async cryptographic operations crashes\nprocess. (CVE-2025-23166)\nImproper HTTP header block termination in llhttp. (CVE-2025-23167)\n","status":"published","published":"2025-05-24T23:25:56Z","modified":"2026-04-16T04:41:20.367854037Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15250-1","title":"corepack22-22.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.851799Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-23166","title":"CVE-2025-23166 in rootio-nodejs - Patched by Root","description":"Root has patched CVE-2025-23166 in the rootio-nodejs package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-27T14:00:06.335890082Z","updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"SUSE-SU-2025:01878-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\nUpdate to version 22.15.1.\n\nSecurity issues fixed:\n\n- CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations\n  (bsc#1243218).\n- CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in\n  `node::fs::ReadFileUtf8(const FunctionCallbackInfo\u003cValue\u003e\u0026 args)` when `args[0]` is a string (bsc#1243217).\n  \nOther changes and issues fixed:\n\n- Changes from version 22.15.0\n\n  * dns: add TLSA record query and parsing\n  * assert: improve partialDeepStrictEqual\n  * process: add execve\n  * tls: implement tls.getCACertificates()\n  * v8: add v8.getCppHeapStatistics() method\n\n- Changes from version 22.14.0\n \n  * fs: allow exclude option in globs to accept glob patterns\n  * lib: add typescript support to STDIN eval\n  * module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX\n  * module: add findPackageJSON util\n  * process: add process.ref() and process.unref() methods\n  * sqlite: support TypedArray and DataView in StatementSync\n  * src: add --disable-sigusr1 to prevent signal i/o thread\n  * src,worker: add isInternalWorker\n  * test_runner: add TestContext.prototype.waitFor()\n  * test_runner: add t.assert.fileSnapshot()\n  * test_runner: add assert.register() API\n  * worker: add eval ts input\n  \n- Build with PIE (bsc#1239949).\n- Fix builds with OpenSSL 3.5.0 (bsc#1241050).\n","status":"published","published":"2025-06-11T05:41:14Z","modified":"2026-02-04T03:37:32.090442Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01879-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\nUpdate to version 22.15.1.\n\nSecurity issues fixed:\n\n- CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations\n  (bsc#1243218).\n- CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in\n  `node::fs::ReadFileUtf8(const FunctionCallbackInfo\u003cValue\u003e\u0026 args)` when `args[0]` is a string (bsc#1243217).\n  \nOther changes and issues fixed:\n\n- Changes from version 22.15.0\n\n  * dns: add TLSA record query and parsing\n  * assert: improve partialDeepStrictEqual\n  * process: add execve\n  * tls: implement tls.getCACertificates()\n  * v8: add v8.getCppHeapStatistics() method\n\n- Changes from version 22.14.0\n \n  * fs: allow exclude option in globs to accept glob patterns\n  * lib: add typescript support to STDIN eval\n  * module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX\n  * module: add findPackageJSON util\n  * process: add process.ref() and process.unref() methods\n  * sqlite: support TypedArray and DataView in StatementSync\n  * src: add --disable-sigusr1 to prevent signal i/o thread\n  * src,worker: add isInternalWorker\n  * test_runner: add TestContext.prototype.waitFor()\n  * test_runner: add t.assert.fileSnapshot()\n  * test_runner: add assert.register() API\n  * worker: add eval ts input\n  \n- Build with PIE (bsc#1239949).\n- Fix builds with OpenSSL 3.5.0 (bsc#1241050).\n","status":"published","published":"2025-06-11T05:41:29Z","modified":"2026-02-04T02:53:17.225122Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02039-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.19.2:\n\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).\n\nOther bugfixes:\n\n- Build with PIE (bsc#1239949)\n","status":"published","published":"2025-06-20T09:40:53Z","modified":"2026-03-23T04:46:25.776131Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02045-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.19.2:\n\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).\n\nOther bugfixes:\n\n- Build with PIE (bsc#1239949)\n","status":"published","published":"2025-06-20T11:04:00Z","modified":"2026-03-23T04:49:34.072515Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2026:4248-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-17T15:59:50Z","modified":"2026-09-18T10:00:04.762818452Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4261-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-18T07:44:28Z","modified":"2026-09-18T18:00:04.233169266Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4355-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n","status":"published","published":"2026-09-28T08:55:58Z","modified":"2026-09-29T09:15:07.942948517Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}